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SPECIAL NOTES 

API publications necessarily address problems of a general nature. With respect to partic- 
ular circumstances, local, state, and federal laws and regulations should be reviewed. 

API is not undertaking to meet the duties of employers, manufacturers, or suppliers to 
warn and properly train and equip their employees, and others exposed, concerning health 
and safety risks and precautions, nor undertaking their obligations under local, state, or fed- 
eral laws. 

Information concerning safety and health risks and proper precautions with respect to par- 
ticular materials and conditions should be obtained from the employer, the manufacturer or 
supplier of that material, or the material safety data sheet. 

Nothing contained in any API publication is to be construed as granting any right, by 
implication or otherwise, for the manufacture, sale, or use of any method, apparatus, or prod- 
uct covered by letters patent. Neither should anything contained in the publication be con- 
strued as insuring anyone against liability for infringement of letters patent. 

Generally, API standards are reviewed and revised, reaffirmed, or withdrawn at least every 
five years. Sometimes a one-time extension of up to two years will be added to this review 
cycle. This publication will no longer be in effect five years after its publication date as an 
operative API standard or, where an extension has been granted, upon republication. Status 
of the publication can be ascertained from the API Upstream Segment [telephone (202) 682- 
8000]. A catalog of API publications and materials is published annually and updated quar- 
terly by API, 1220 L Street, N.W., Washington, DC. 20005. 

This document was produced under API standardization procedures that ensure appropri- 
ate notification and participation in the developmental process and is designated as an API 
standard. Questions concerning the interpretation of the content of this standard or com- 
ments and questions concerning the procedures under which this standard was developed 
should be directed in writing to the general manager of the Upstream Segment, American 
Petroleum Institute, 1220 L Street, N.W., Washington, D.C. 20005. Requests for permission 
to reproduce or translate all or any part of the material published herein should also be 
addressed to the general manager. 

API standards are published to facilitate the broad availability of proven, sound engineer- 
ing and operating practices. These standards are not intended to obviate the need for apply- 
ing sound engineering judgment regarding when and where these standards should be 
utilized. The formulation and publication of API standards is not intended in any way to 
inhibit anyone from using any other practices. 

Any manufacturer marking equipment or materials in conformance with the marking 
requirements of an API standard is solely responsible for complying with all the applicable 
requirements of that standard. API does not represent, warrant, or guarantee that such prod- 
ucts do in fact conform to the applicable API standard. 
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FOREWORD 

This standard was developed as an API recommended practice under the jurisdiction of 
the API Upstream Segment Executive Committee on Drilling and Production Operations. 

This recommended practice presents a standardized method to design, install, and test sur- 
face safety systems on offshore production platforms and is intended for use by design engi- 
neers and operating personnel. Recognized systems analysis methods are used to develop 
requirements for a safety system and procedures are included to document the safety system 
and verify conformance with the recommended practice. 

Other API recommended practices for safety and antipollution systems used in offshore 
oil and gas production include the following: 

RP 14E Design and Installation of Offshore Production Platform Piping Systems 
RP 14F Design and Installation of Electrical Systems for Fixed and Floating Off- 
shore Petroleum, Facilities for Unclassified and Class /, Division I and 
Division 2 Locations 
RP 14G Fire Prevention and Control on Open Type Offshore Production Plat- 
forms 
RP 14J Design and Hazards Analysis for Offshore Production Facilities 
RP 75 Development of a Safety and Environmental Management Program for 
Outer Continental Shelf (OCS) Operations and Facilities 

API publications may be used by anyone desiring to do so. Every effort has been made by 
the Institute to assure the accuracy and reliability of the data contained in them; however, the 
Institute makes no representation, warranty, or guarantee in connection with this publication 
and hereby expressly disclaims any liability or responsibility for loss or damage resulting 
from its use or for the violation of any federal, state, or municipal regulation with which this 
publication may conflict. 

Suggested revisions are invited and should be submitted to the general manager, Ustream 
Segment, American Petroleum Institute, 1220 L Street, N.W., Washington, D.C. 20005. 

This publication shall become effective on the date printed on the cover but may be used 
voluntarily from the date of distribution. 



CONTENTS 

Page 

1. GENERAL 

1 . 1 Introduction 

1 .2 Scope 

1.3 Organization of Technical Content 

1 .4 Government Codes, Rules, and Regulations 

1.5 Industry Codes, Standards, and Recommended Practices 2 

1 .6 Metric Conversions 3 

2. SAFETY DEVICE SYMBOLS AND IDENTIFICATION 3 

2.1 Introduction 3 

2.2 Functional Device Identification 3 

2.3 Symbols 3 

2.4 Component Identification 3 

2.5 Example Identification 3 

3. INTRODUCTION TO SAFETY ANALYSIS AND SYSTEM DESIGN 7 

3.1 Purpose and Objectives , 7 

3.2 Safety Flow Chart 7 

3.3 Modes of Safety System Operation 7 

3.4 Premises for Basic Analysis and Design 7 

4. PROTECTION CONCEPTS AND SAFETY ANALYSIS 8 

4. 1 Introduction 8 

4.2 Protection Concepts 8 

4.3 Safety Analysis 15 

4.4 Analysis and Design Procedure Summary 16 

APPENDIX A PROCESS COMPONENT ANALYSIS 17 

APPENDIX B ANALYSIS TABLES 55 

APPENDIX C SUPPORT SYSTEMS 63 

APPENDIX D TESTING AND REPORTING PROCEDURES 69 

APPENDIX E EXAMPLES OF SAFETY ANALYSIS FLOW DIAGRAM AND 
SAFETY ANALYSIS FUNCTION EVALUATION 

(SAFE) CHART 75 

APPENDIX F TOXIC GAS SECTION 87 

APPENDIX G DEFINITIONS 91 

Figures 

2- 1 Examples of Safety Device Identification 5 

3- 1 Safety Flow Chart — Offshore Production Facility 9 

A- 1 . 1 Recommended Safety Devices — Wellhead Flow Lines 19 

A-l .2Recommended Safety Devices — Underwater Wellhead Flow Lines 20 

A-l .3Recommended Safety Devices— Satellite Well 21 

A- 2 Recommended Safety Devices — Wellhead Injection Lines 23 

A-3 Recommended Safety Devices— Headers 25 

A-4 Recommended Safety Devices — Pressure Vessel 27 

A- 5 Recommended Safety Devices — Atmospheric Vessels 30 

A-6.1 Recommended Safety Devices — Typical Fired Vessel (Natural Draft) 34 

A-6.2Recommended Safety Devices — Typical Fired Vessel (Forced Draft) 35 

A-6. 3 Recommended Safety Devices — Exhaust Heated Component 36 



Page 

A -7. 1 Recommended Safety Devices — Pipeline Pump 41 

A- 7. 2 Recommended Safety Devices — Glycol Powered Glycol Pump 42 

A-7. 3 Recommended Safety Devices — Other Pump 43 

A- 8 Recommended Safety Devices — Compressor Unit 46 

A-9 Recommended Safety Devices — Pipelines 49 

A- 10 Recommended Safety Devices — Heat Exchangers (Shell-Tube) 52 

B-l Safety Analysis Function Evaluation Chart (SAFE) 62 

E- 1.1 Example Safety Analysis Flow Diagram of Platform Production Process 77 

E- 1 .2 Safety Analysis Function Evaluation Chart (SAFE) 79 

E-2.1 83 

E^2.2 84 

E-2.3 Safety Analysis Function Evaluation Chart (SAFE) 85 

Tables 

2-1 Safety Device Symbols 4 

2-2 Component Identification 6 

A- 1.1 Safety Analysis Table (SAT)— Flow Line Segment 22 

A-1.2Safety Analysis Checklist (SAC)— Flow Line Segment 22 

A-2.1 Safety Analysis Table (SAT)— Wellhead Injection Lines 24 

A-2.2Safety Analysis Checklist (SAC) — Wellhead Injection Lines 24 

A-3.1 Safety Analysis Table (SAT)— Headers 26 

A-3.2Safety Analysis Checklist (SAC)— Headers 26 

A-4. 1 Safety Analysis Table (SAT) Pressure Vessels 28 

A-4.2Safety Analysis Checklist (SAC)— Pressure Vessels 29 

A-5.1 Safety Analysis Table (SAT) — Atmospheric Vessels 31 

A-5.2Safety Analysis Checklist (SAC) — Atmospheric Vessels 31 

A-6.1 Safety Analysis Table (SAT)— Fired Components Natural Draft 37 

A-6.2Safety Analysis Table (SAT) — Fired Components Forced Draft 37 

A- 6. 3 Safety Analysis Table (SAT) — Exhaust Heated Components 37 

A-6.2Safety Analysis Checklist (SAC) — Fired and Exhaust Heated Components . . . . 38 

A-6.3Safe Operating Procedures 39 

A-7. 1 Safety Analysis Table (SAT)— Pumps 44 

A-7.2Safety Analysis Checklist (SAC)— Pumps 44 

A-8.1 Safety Analysis Table (SAT) — Compressors 47 

A-8.2Safety Analysis Checklist (SAC) — Compressors 47 

A-9. 1 Safety Analysis Table (SAT)— Pipelines 50 

A-9.2Safety Analysis Checklist (SAC)— Pipelines 50 

A- 10.1 Safety Analysis Table (SAT)— Heat Exchangers (Shell-Tube) 53 

A- 10.2 Safety Analysis Checklist (SAC)— Heat Exchangers (Shell-Tube) 53 

B-l Safety Analysis Table (SAT) 55 

B-l Composite Safety Analysis Checklist (SAC) 56 

C-l Guidelines for Fusible Plug Installations 67 

D-l Safety Device Test Data Safety Device 71 

D-2 Safety Device Test Procedures 72 



Recommended Practice for Analysis, Design, Installation, and 
Testing of Basic Surface Safety Systems for Offshore Production Platforms 

1. GENERAL 



1.1 INTRODUCTION 

For many years the petroleum industry has prepared docu- 
ments representing the combined knowledge and experience 
of industry on various phases of oil and gas producing opera- 
tions, in continuation of this effort, this recommended prac- 
tice presents a systematization of proven practices for 
providing a basic surface safety system for offshore produc- 
tion platforms. Proper application of these practices, along 
with good design, maintenance, and operation of the entire 
production facility, should provide an operationally safe plat- 
form. 

1.2 SCOPE 

This document presents recommendations for designing, 
installing, and testing a basic surface safety system on an off- 
shore production platform. The basic concepts of a platform 
safety system are discussed and protection methods and 
requirements of the system are outlined. 

This recommended practice illustrates how system analysis 
methods can be used to determine safety requirements to pro- 
tect any process component. Actual analyses of the principal 
components are developed in such a manner that the require- 
ments determined will be applicable whenever the compo- 
nent is used in the process. The safety requirements of the 
individual process components may then be integrated into a 
complete platform safety system. The analysis procedures 
include a method to document and verity system integrity. A 
uniform method of identifying and symbolizing safety 
devices is presented and the analysis method is exemplified 
by a sample process system. 

In addition to the basic surface safety system, this recom- 
mended practice covers ancillary systems such as pneumatic 
supply and liquid containment. Procedures for testing com- 
mon safety devices are presented with recommendations for 
test data and acceptable test tolerances. 

This recommended practice emphasizes pneumatic sys- 
tems since they are the most commonly used; however, the 
same principles and procedures are applicable to hydraulic 
and electrical systems and to systems incorporating two or 
more control media. Instrumentation logic circuits are not 
discussed since these should be left to the discretion of the 
designer as long as the recommended safety functions are 
accomplished. Rotating machinery is considered in this rec- 
ommended practice as a unitized process component as it 
interfaces with the platform safety system. When rotating 
machinery (such as a pump or compressor) installed as a unit 



consists of several process components, each component can 
be analyzed as prescribed in this recommended practice. 

1 .3 ORGANIZATION OF TECHNICAL CONTENT 

The technical content of this recommended practice is 
arranged as follows: 

a. Section 2: Recommended standard symbols and abbrevia- 
tions for safety device and process component identification. 

b. Section 3: The general purpose, functional requirements, 
and basic premises of platform safety system analysis and 
design. 

c. Section 4: A detailed discussion of recommended safety 
analysis techniques, the concepts of protection from which 
they were developed, and a step-by-step procedure for ana- 
lyzing and establishing design criteria for a basic platform 
safety system. 

d. Appendix A: A safety analysis for each process compo- 
nent commonly used in a production process, including a 
checklist of additional criteria that should be considered 
when the component is used in a specific process configura- 
tion. 

e. Appendix B: A sample Safety Analysis Table (SAT), a 
composite Safety Analysis Checklist (SAC), and a sample 
Safety Analysis Function Evaluation (SAFE) Chart. 

f. Appendix C: A discussion of supporting systems that per- 
form specific safety functions common to the entire platform. 

g. Appendix D: Testing procedures and reporting methods 
for the accumulation of safety system test data that can be 
used for operational analysis, and reports that may be 
required by regulatory agencies. 

h. Appendix E: An example Safety Analysis Function Evalu- 
ation (SAFE) Chart prepared using procedures presented in 
this recommended practice. 

i. Appendix F: A discussion of procedures and location of 
detectors for platforms that process toxic hydrocarbons. 

1.4 GOVERNMENT CODES, RULES, AND 

REGULATIONS 

Regulatory agencies have established certain requirements 
for the design, installation, and operation of facilities on off- 
shore production platforms. In addition to federal regulations, 
certain state and local regulations may be applicable. The fol- 
lowing federal documents pertain to offshore oil and gas pro- 
ducing operations and should be used when applicable. 



Analysis, Design, Installation, and Testing of Basic Surface Saftey Systems for Offshore Production Platforms 



30 Code of Federal Regulations Part 250 (Oil and Gas Sul- 
phur Operations in the Outer Continental Shelf) 

33 Code of Federal Regulations Chapter I, Subchapter N 
(Artificial Islands and Fixed Structures on the Outer Conti- 
nental Shelf) 

40 Code of Federal Regulations Part 1 12, Chapter I, Sub- 
chapter D (Oil. Pollution Prevention) 

49 Code of Federal Regulations Part 1 92 (Transportation 
of Natural and Other Gas by Pipeline: Minimum Federal 
Safety Standards) 

49 Code of Federal Regulations Part 195 (Transportation 
of Liquids by Pipeline) 

Minerals Management Service, Notice to Lessees and 
Operators of all Federal Oil, Gas, and Sulphur Leases on the 
Outer Continental Shelf (NFL) and Letters to Lessees and 
Operators (LTL) 

1.5 INDUSTRY CODES, STANDARDS, AND 
RECOMMENDED PRACTICES 

Various organizations have developed numerous standards, 
codes, specifications, and recommended practices that are 
useful references for designing and installing surface safety 
systems on offshore production facilities. Some of the more 
commonly used documents are listed below. These docu- 
ments are not considered to be a part of this recommended 
practice, except for those specific sections of documents ref- 
erenced elsewhere in this recommended practice. 
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API 510 Pressure Vessel Inspection Code: Mainte- 
nance Inspection, Rating, Repair, and 
Alteration 

RP 1.4B Design, Installation and Operation of Sub- 
surface Safety Valve Systems 

RP 14E Design and Installation of Offshore Pro- 
duction Platform Piping Systems 

RP 1 4F Design and Installation of Electrical Sys- 
tems for Fixed and Floating Offshore 
Petroleum. Facilities for Unclassified and 
Class J, Division I and Division 2 Loca- 
tions 

RP 14G Fire Prevention and Control on Open Type 
Offshore Production Platforms 

RP 14H. Use of Surface Safety Valves and Under- 
water Safety Valves Offshore 

RP 1 4J Design and Hazards Analysis for Offshore 
Production Facilities 

RP 500 Classification of Locations for Electrical 
Installations at Petroleum Facilities 



RP 505 Classification of Locations for Electrical 
Installations at Petroleum Facilities Classi- 
fied as Class I, Zone 0, Zone I and Zone 2 
RP 520 Design and Installation of Pressure- 
Relieving Systems in Refineries, Parts I 
and II 
RP 521 Guide for Pressure-Relieving and Depres- 

suring Systems 
RP 550 Manual on Installation of Refinery Instru- 
ments and Control Systems 
Spec 6A Wellhead Equipment 
Spec 6D Pipeline Valves, End Closures, Connec- 
tors, and Swivels 
Spec 14A Subsurface Safety Valve Equipment 
Std 2000 Venting Atmospheric and Low Pressure 

Storage Tanks 
Std 2564 Conversion of Operational and Process 

Measurement Unit to the Metric System 
Spec Ql Specification for Quality Programs 
Guide for Inspection of Refinery Equipment, Chapter XV, 

"Instruments and Control Equipment" 
Guide for Inspection of Refinery Equipment, Chapter XVI, 
"Pressure-Relieving Devices" 



ANSI 1 



ASME 2 



ISA 3 



B31.3 Petroleum Refinery Piping 

B3I.4 Liquid Petroleum Transportation Piping 
Systems 

B3L8 Gas Transmission and Distribution Piping 
Systems 
Y32.1 1 Graphical Symbols for Process Flow Dia- 
grams 

Boiler and Pressure Vessel Code, Section 
VIII, "Pressure Vessels " Divisions 1 and 2 



RP 7.1 Pneumatic Control Circuit Pressure Test 
RP42.1 Nomenclature for Instrument Tubing Fit- 
tings 
55.1 Instrumentation Symbols and Identifica- 
tion 
RP 60.9 Piping Guide for Control Centers 

S20 Specification Forms for Process Measure- 
ment and Control Instruments, Primary 
Elements and Control Valves 
102-198X Standard for Gas Detector Tube Units — 
Short Term- Type for Toxic Gases and 
Vapors in Working Environments 



'American National Standards Institute, 1430 Broadway, New York, 

New York 10018 

2 American Society of Mechanical Engineers, 345 East 47th Street, 

New York, New York 10017 

instrument Society of America, 67 Alexander Drive, P.O. 

Box 12277, Research Triangle Park, North Carolina 27709 
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S12.15 



S12.15 



S12.13 



S12.13 



NACE 4 

StdMR0175 



Part I, Performance Requirements, Hydro- 
gen Sulfide Gas Detectors 
Part II, Installation, Operation, and Main- 
tenance of Hydrogen Sulfide Gas Detec- 
tion Instruments 

Part I, Performance Requirements, Com- 
bustible Gas Detectors 
Part II, Installation, Operation, and Main- 
tenance of Combustible Gas Detection 
Instruments 



Standard Material Requirements Sulfide 
Stress Cracking Resistant Metallic Materi- 
als For Oilfield Equipment 



4 National Association of Corrosion Engineers, P.O. Box 218340, 
Houston, Texas 772 1 8-8340 



1.6 METRIC CONVERSIONS 

U.S. customary units are in all cases preferential and shall 
be the standard in this recommended practice. These factors 
were taken from API Standard 2564. 

a. Length: 1 inch (in.) = 25.4 millimeters (mm) exactly. 

b. Pressure: 1 pound per square inch (psi) = 0.06894757 bar 
(Note: 1 bar- 100 kilopascals (kPa)). 

c. Strength or stress: 1 pound per square inch (psi) = 
0.006894757 megapascals (MPa). 

d. Impact energy: 1 foot-pound (ft-lb) - 1.355818 Joules (J). 

e. Torque: 1 foot-pound (ft-lb) = 1.355818 newton- 
meters (N • m). 

f. Temperature: The following formula was used to convert 
degrees Fahrenheit (T) to degrees Celsius (°C): 

C = 5/9 (F-32) 

g. Mass: 1 pound (lb) = 0.4535924 kilograms (kg). 



2. SAFETY DEVICE SYMBOLS AND IDENTIFICATION 



2.1 INTRODUCTION 

A standard method for identifying, abbreviating, and sym- 
bolizing individual safety devices is needed to promote uni- 
formity when describing or referring to safety systems. This 
method can be used to illustrate safety devices on flow dia- 
grams and other drawings, and to identify an individual safety 
device for any purpose. 

Abbreviations and symbols recommended are derived, 
insofar as possible, from Instrument Society of America 
(ISA) Standard ISA-S5.1. Additional applications that adhere 
to this standard may be derived as required. However, certain 
abbreviations have such wide oil field acceptance that their 
continued use is justified even though they do not strictly con- 
form to the ISA standard. The abbreviations SSV for surface 
safety valve, SDV for shutdown valve, and BSD for emer- 
gency shutdown are examples. 

2.2 FUNCTIONAL DEVICE IDENTIFICATION 

Each safety device should be identified by a system of let- 
ters used to classify it functionally. The functional identifica- 
tion includes one first letter covering the measured or 
initiating variable and one or more succeeding letters cover- 
ing the function of the device. The term "safety" (S) shall 
apply to emergency protective elements, and is used as the 
second letter of sensing and self-acting devices. 

If two or more devices of the same type are installed on a 
single component, each device should be numbered consecu- 
tively and the number shown following the functional identi- 
fication. If only one device is installed, the device number 
may be omitted. 



2.3 SYMBOLS 

The circular balloon is used to tag distinctive symbols, 
such as a pressure relief valve. In such instances, the line con- 
necting the balloon to the instrument symbol is drawn close 
to, but not touching, the symbol. In other instances, the bal- 
loon serves to represent the device proper Table 2-1 illus- 
trates recommended example symbols. 

2.4 COMPONENT IDENTIFICATION 

The complete identification of a safety device includes ref- 
erence to the component that it protects. This is accomplished 
by following the device functional identification or device 
number, if applicable, with a component identification. Table 
2-2 presents the recommended component identification 
method. 

The first letter is the component type and must be one of 
the letters in the code column under component type. The let- 
ter "Z" is used to cover a component not listed. 

The second and third letters may be used to further define 
or otherwise modify the first character. If a modifier is not 
used, the character "())" should be shown in lieu of the modi- 
fier. 

The last four characters identify the specific component. 
These characters are user assigned and must be unique to the 
component at the particular location. 

2.5 EXAMPLE IDENTIFICATION 

Example applications of the recommended identification 
method are illustrated in Figure 2- 1 . 
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Table 2.1— Safety Device Symbols 



SENSING AND SELF-ACTING DEVICE 



VARIABLE 



SAFETY DEVICE DESIGNATION 



COMMON 



INSTRUMENT SOCIETY 
OF AMERICA (ISA) 



SYMBOL 



SINGLE DEVICE 



COMBINATION 
DEVICE 



Backflow 



Burner flame 



Check valve 



Flow Safety Valve 



^sv) 



Burner flame detector 



Burner Safety Low 



Flow 



High flow sensor 



Flow Safety High 



(FSH) 



Low flow sensor 



Flow Safety Low 



Level 



High level sensor 



Level Safety High 



(LSH) 



Low level sensor 



Level Safety Low 



Ishl) 



Pressure 



Pressure 



Vacuum 



High pressure sensor 



Pressure Safety High 



!psh> 

T 



Low pressure sensor 



Pressure Safety Low 



Pressure relief 

or 

safety valve 



Pressure Safety Valve 




Rupture disc or 
safety head 



Pressure Safety Element 



Jg|-j{F 



Pressure-vacuum 
relief valve 



Pressure Safety Valve 



~>%F^i 



Pressure-vacuum 
relief manhole cover 



Pressure Safety Valve 



TT 



Vent 



None 



Vacuum relief valve 



Pressure Safety Valve 



*4t 



/ps< 



Rupture disc or 
safety head 



Pressure Safety Element 



ffi -j{P SE} 



Temperature 



High temperature sensor 



Temperature Safety High 



Low temperature sensor 



Temperature Safety Low 



(TSL) 



[TSHLJ 

Y 



Flame 



Flame or stack 
arrestor 



None 
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Table 2.1— Safety Device Symbols (continued) 



SENSING AND SELF-ACTING DEVICE 


VARIABLE 


SAFETY DEVICE DESIGNATION 


SYMBOL 


COMMON 


INSTRUMENT SOCIETY 
OF AMERICA (ISA) 


SINGLE DEVICE 


COMBINATION 
DEVICE 


Fire 


Flame detector 

(Ultraviolet/ 

tnfared) 




(ush) 




Heat detector 
(Thermal) 


Temperature 
Safety High 


© 




Smoke detector 
(ionization) 




(ysh) 


Fusible material 


Temperature 
Safety Element 


© 


Combustible gas 
concentration 


Combustible gas 
detector 


Analyzer 
Safety High 


(ash) 


Toxic gas 
concentration 


Toxic gas 
detector 




(osh) 



ACTUATED VALVES 


SERVICE 


COMMON SYMBOLS 


Wellhead surface safety 
valve or underwater 
safety valve 




?-&P 


Note: Show "USV" for Underwater 
Safety Valves 


Blow down valve 




&@> 


h£^ 


h t^ 


All other 

shut down valves 




O^ 


^P 


h &P 



EXAMPLE A 



PSV 



ABJ1000 



P 



Pressure 



Device 

/\ 



Safety 



— \ 
V 



Va ue 



A 



Atmospheric 
Vessel 



Component 



BJ 



Tank 



1000 



Specific 
Tank 



EXAMPLE B 



r 
P 



Pressure 



l 



Device 



Safety High 



PSH2 



2 



Device 
Number 



C1000 

I 



Compressor 



Component 




No 
Modifier 



1000 



Specific 
Compressor 



Figure 2-1 — Examples of Safety Device Identification 
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Table 2-2— Component Identification 



FIRST 
LETTER 



SECOND 
LETTER 



SUCCEEDING 
CHARACTERS 



XX 



XXX 





Component 
Type 






Component 
Modifier 


Component 
Identifier 


CODE 


COMPONENT 

ATMOSPHERIC VESSEL 
(AMBIENT TEMPERATURE) 


COMMON 
MODIFIERS 

BH,BJ,BM 


CODE 

AA 


COMPONENT 
BI-DIRECTIONAL 




A 


User Assigned 
Identification Unique 


B 


ATMOSPHERIC VESSEL 
(HEATED) 


AP,BC,BK,BM 


AB 


BLOWCASE 


to Equipment at Location 


C 


COMPRESSOR 


NONE 


AC 


BOILER 




D 


ENCLOSURE 


AE,AN,AU,BB 


AD 


COALESCER 




E 


FIRED OR EXHAUST 
HEATED COMPONENT 


AL,AW,BN 


AE 


COMPRESSOR 




F 


FLOWLINE 


A1-A9 


AF 


CONTACTOR 




G 


HEADER 


AR,AS,AT,AY,AZ 


AG 


CONTROL UNIT 




H 


HEAT EXCHANGER 


BG 


AH 


DEPARTING 




J 


INJECTION LINE 


AR,AS,AT 


AJ 


FILTER 




K 


PIPELINE 


AA,AH,AQ 


AK 


FILTER-SEPARATOR 




L 


PLATFORM 


AG 


AL 


FORCED DRAFT 




M 


PRESSURE VESSEL 
(AMBIENT TEMPERATURE) 


AB,AD,AF,AJ,AK,AM, 
AV,BD,BF,BH,BJ,BL,BM 


AM 


FREEWATER KNOCKOUT 




N 


PRESSURE VESSEL 
(HEATED) 


AC,AF,AM,AP,BC,BD, 
BG,BJ,BK 


AN 


GENERATOR 




P 


PUMP 


AX,BA,BE 


AP 


HEATER 




Q 


WELLHEAD 


AR,AT,AY,AZ 


AQ 


INCOMING 




z 


OTHER 




AR 
AS 
AT 
AU 
AV 
AW 
AX 
AY 
AZ 
AI-A9 
BA 
BB 
BC 
BD 
BE 
BF 
BG 
BH 
BJ 
BK 
BL 
BM 
BN 
ZZ 


INJECTION, GAS 

INJECTION, GAS LIFT 

INJECTION, WATER 

METER 

METERING VESSEL 

NATURAL DRAFT 

PIPELINE 

PRODUCTION, HYDROCARBON 

PRODUCTION, WATER 

FLOWLINE SEGMENT 

PROCESS, OTHER 

PUMP 

REBOILER 

SEPARATOR 

SERVICE 
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TREATER 

VOLUME BOTTLE 

WATER TREATING 

EXHAUST HEATED 

OTHER 
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3. INTRODUCTION TO SAFETY ANALYSIS AND SYSTEM DESIGN 



3.1 PURPOSE AND OBJECTIVES 

The purpose of a production platform surface safety sys- 
tem is to protect personnel, the environment, and the facility 
from threats to safety caused by the production process. The 
purpose of a safety analysis is to identify undesirable events 
that might pose a threat to safety, and define reliable protec- 
tive measures that will prevent such events or minimize their 
effects if they occur. Potential threats to safety are identified 
through proven systems analysis techniques that have been 
adapted to the production process. Recommended protective 
measures are common industry practices proven through long 
experience. The systems analysis and protective measures 
have been combined into a "safety analysis" for offshore pro- 
duction platforms. 

The technical content of this recommended practice estab- 
lishes a firm basis for designing and documenting a produc- 
tion platform safety system for a process composed of 
components and systems normally used offshore. Moreover, 
it establishes guidelines for analyzing components or systems 
that are new or significantly different from those covered in 
this document. 

After a production platform surface safety system is placed 
in operation, procedures should be established to assure con- 
tinued system integrity. Appendix D, Testing and Reporting 
Procedures, may be used for this purpose. 

3.2 SAFETY FLOW CHART 

Figure 3-1 is a safety flow chart depicting the manner in 
which undesirable events could result in personnel injury, 
pollution, or facility damage. It also shows where safety 
devices or procedures should be used to prevent the propaga- 
tion of undesirable events. As shown on the chart, the release 
of hydrocarbons is a factor in virtually all threats to safety. 
Thus, the major objective of the safety system should be to 
prevent the release of hydrocarbons from the process and to 
minimize the adverse effects of such releases if they occur. 

a. Referring to Figure 3-1, the overall objectives may be enu- 
merated as follows: 

1. Prevent undesirable events that could lead to a release 
of hydrocarbons. 

2. Shut in the process or affected part of the process to 
stop the flow of hydrocarbons to a leak or overflow if it 
occurs. 

3. Accumulate and recover hydrocarbon liquids and dis- 
perse gases that escape from the process. 

4. Prevent ignition of released hydrocarbons. 

5. Shut in the process in the event of a fire. 

6. Prevent undesirable events that could cause the release 
of hydrocarbons from equipment other than that in which 
the event occurs. 



b. Accidents that occur external to the process on a produc- 
tion platform are not self-propagating unless they affect the 
process or start a fire. If they affect the process, the safety sys- 
tem should shut down the process or affected part of the pro- 
cess. If they result in fire, the safety system should shut down 
all platform activity except that necessary for fire fighting. 
Such accidents may be caused by natural phenomenon, ship 
or helicopter collision, failure of tools and machinery, or mis- 
takes by personnel. These types of accidents may be pre- 
vented or minimized through safe design of tools and 
machinery, safe operating procedures for personnel and 
equipment, and personnel training. Figure 3-1 indicates the 
manner in which external accidents may affect the process. 

3.3 MODES OF SAFETY SYSTEM OPERATION 

The operating modes of the safety system should be (a) 
automatic monitoring and automatic protective action if an 
abnormal condition indicating an undesirable event can be 
detected by a sensor, (b) automatic protective action if manu- 
ally actuated by personnel who observe or are alerted to an 
unsafe condition by an alarm, and (c) continuous protection 
by support systems that minimize the effects of escaping 
hydrocarbons. The Emergency Shutdown (ESD) System is 
important, even on platforms that are not continuously 
manned, because most accidents and failures are caused by 
personnel. Thus, personnel may be available to actuate the 
ESD System. 

3.4 PREMISES FOR BASIC ANALYSIS AND 
DESIGN 

The recommended analysis and design procedures for a 
platform safety system are based on the following premises: 

a. The process facility will be designed for safe operation in 
accordance with good engineering practices. 

b. The safety system should provide two levels of protection 
to prevent or minimize the effects of an equipment failure 
within the process. The two levels of protection should be 
independent of and in addition to the control devices used in 
normal process operation. In general, the two levels should be 
provided by functionally different types of safety devices for 
a wider spectrum of coverage. Two identical devices would 
have the same characteristics and might have the same inher- 
ent weaknesses. 

c. The two levels of protection should be the highest order 
(primary) and next highest order (secondary) available. Judg- 
ment is required to determine these two highest orders for a 
given situation. As an example, two levels of protection from 
a rupture due to overpressure might be provided by a PSH 
and a PSL. The PSH prevents the rupture by shutting in 
affected equipment before pressure becomes excessive, and 
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the PSL shuts in affected equipment after the rupture occurs. 
However, a PSV is selected in lieu of the PSL because it pre- 
vents the rupture by relieving excess volumes to a safe loca- 
tion. Moreover, its fast response could prevent a rupture in 
situations where the PSH might not effect corrective action 
fast enough. 

d. The use of proven systems analysis techniques, adapted to 
the production process, will determine the minimum safety 
requirements for a process component. If such an analysis is 
applied to the component as an independent unit, assuming 
worst case conditions of input and output, the analysis will be 
valid for that component in any process configuration. 



e. All process components on a production platform com- 
prise the entire process from the wellhead to the most down- 
stream discharge point; thus, all process equipment and 
functions are incorporated into the safety system. 

f. When fully protected process components are combined 
into a facility, no additional threats to safety are created. 
Therefore, if all process component safety devices are logi- 
cally integrated into a safety system, the entire facility will be 
protected. 

g. The analysis procedure should provide a standard method 
to develop a safety system and provide supporting documen- 
tation. 



4. PROTECTION CONCEPTS AND SAFETY ANALYSIS 



4.1 INTRODUCTION 

Section 3.1 emphasizes that most threats to safety from the 
production process involve the release of hydrocarbons. Thus, 
the analysis and design of a production platform safety sys- 
tem should focus on preventing such releases, stopping the 
flow of hydrocarbons to a leak if it occurs, and minimizing 
the effects of hydrocarbons that are released. 

Section 4.2 explains the basic concepts of protection used 
in the analysis. These concepts are repeated in Appendix A, 
as applicable to individual component analysis. 

Section 4.3 discusses methods of analyzing the process and 
establishing design criteria for an integrated safety system 
covering the entire platform process. These methods are 
exemplified in the example analysis illustrated in Appendix E. 

Section 4.4 is a step-by-step summary for performing a 
safety analysis in accordance with this document. It is pointed 
out that this method initially considers each component inde- 
pendently from the rest of the process, and may recommend 
safety devices that are not required after larger segments of 
the process are considered. For example, many safety devices 
initially considered on headers are not normally required 
because their safety function is performed by devices on other 
components. 

4.2 PROTECTION CONCEPTS 

The basic protection concepts used in the safety system 
analysis are discussed in this paragraph. Section 4.2. 1 
describes each undesirable event that could affect a process 
component and considers its cause, effect, and protective 
measures. Section 4.2.2 discusses safety device selection cri- 
teria. Section 4.2.3 discusses protective shut in action for iso- 
lating a process component. Section 4.2.4 discusses ignition 
preventing measures that can be used to minimize the possi- 
bility of combustible concentrations of hydrocarbons contact- 
ing an ignition source. Section 4.2.5 discusses protective 



measures to prevent accidental contact of hot surfaces by per- 
sonnel. Section 4.2.6 discusses the function of the Emergency 
Support System (ESS). Section 4.2.7 discusses the function 
of other support systems. 

4.2.1 Undesirable Events 

An undesirable event is an adverse occurrence in a process 
component that poses a threat to safety. The undesirable 
events discussed in this paragraph are those that might 
develop in a process component under worst-case conditions 
of input and output. An undesirable event may be indicated 
by one or more process variables ranging out of operating 
limits. These abnormal operating conditions can be detected 
by sensors that initiate shut down action to protect the process 
component. Each undesirable event that can affect a process 
component is discussed according to the following format: (a) 
cause, (b) effect and detectable abnormal condition, and (c) 
primary and secondary protection that should prevent or react 
to its occurrence. 

4.2.1.1 Overpressure 

Overpressure is pressure in a process component in excess 
of the maximum allowable working pressure. 

4.2.1.1.1 Cause 

Overpressure can be caused by an input source that will 
develop pressure in excess of a process component's maxi- 
mum allowable working pressure if inflow exceeds outflow. 
Inflow may exceed outflow if an upstream flowrate control 
device fails, if there are restrictions or blockage in the compo- 
nent's outlets, or if overflow or gas blow-by from an upstream 
component occurs. Overpressure can also be caused by ther- 
mal expansion of fluids within a component if heat is added 
while the inlets and outlets are closed. 
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4.2.1 .1 .2 Effect and Detectable Abnormal 
Condition 

The effect of overpressure can be a sudden rupture and leak 
of hydrocarbons. High pressure is the detectable abnormal 
condition that indicates that overpressure may occur. 

4.2.1.1.3 Primary Protection 

Primary protection from overpressure in a pressure compo- 
nent should be provided by a PSH sensor to shut off inflow. If 
a vessel is heated, the PSH sensor should also shut off the fuel 
or source of heat. Primary protection for atmospheric compo- 
nents should be provided by an adequate vent system. 

4.2.1.1.4 Secondary Protection 

Secondary protection from overpressure in a pressure com- 
ponent should be provided by a PSV. Secondary protection for 
atmospheric components should be provided by a second vent. 
The second vent may be identical to the primary vent, a gauge 
hatch with a self-contained PSV or an independent PSV. 

4.2.1 .1 .5 Location of Safety Devices 

In a process component with both a liquid and a gas sec- 
tion, the PSH sensor, PSV, or vent should be installed to 
sense or relieve pressure from the gas or vapor section. 
The sensing connections for the safety devices should be 
located at the highest practical location on the component 
to minimize the chance of fouling by flow stream contami- 
nants. The installation of PSVs and vents on atmospheric 
tanks should be in accordance with API Standard 2000 or 
other applicable standards. 

4.2.1.2 Leak 

A leak is the accidental escape of fluids from a process 
component to atmosphere. In this recommended practice, 
"leak" implies that the escaping fluids are hydrocarbons. 

4.2.1.2.1 Cause 

A leak can be caused by deterioration from corrosion, ero- 
sion, mechanical failure, or excess temperature; by rupture 
from overpressure; or by accidental damage from external 
forces. 

4.2.1 .2.2 Effect and Detectable Abnormal 
Conditions 

The effect of a leak is the release of hydrocarbons to the 
atmosphere. Low pressure, backflow, and low level are the 
abnormal conditions that might be detectable to indicate that 
a leak has occurred. 



4.2.1.2.3 Primary Protection 

Primary protection from leaks of sufficient rate to create an 
abnormal operating condition within a pressure component 
should be provided by a PSL sensor to shut off inflow and a 
FSV to minimize backflow. Primary protection from leaks 
from the liquid section may also be provided by an LSL sen- 
sor to shut off inflow. On an atmospheric component, primary 
protection from liquid leaks should be provided by an LSL 
sensor to shut off inflow. A containment system should pro- 
vide primary protection from small liquid leaks that cannot be 
detected by the safety devices on a process component. Pri- 
mary protection from small gas leaks that occur in an inade- 
quately ventilated area and cannot be detected by component 
sensing devices should be provided by a combustible gas 
detection system. 

4.2.1.2.4 Secondary Protection 

Secondary protection from all detectable leaks and small 
gas leaks in an inadequately ventilated area should be pro- 
vided by the Emergency Support Systems (ESS). Secondary 
protection from small liquid leaks should be provided by an 
LSH sensor installed on the sump tank to shut in all compo- 
nents that could leak into the sump. 

4.2.1.2.5 Location of Safety Devices 

In a process component with both a liquid and a gas sec- 
tion, the PSL sensor should be connected to sense pressure 
from the gas or vapor section. The PSL sensor should be 
installed at the highest practical location on the component to 
minimize the chances of fouling by flow stream contami- 
nants. FSVs should be installed in each component operating 
outlet line subject to significant backflow. The LSL sensor 
should be located a sufficient distance below the lowest oper- 
ating liquid level to avoid nuisance shutdowns, but with ade- 
quate volume between the LSL sensor and liquid outlet to 
prevent gas blowby before shutdown is accomplished. 

4.2.1.3 Liquid Overflow 

Liquid overflow is the discharge of liquids from a process 
component through a gas or vapor outlet. 

4.2.1.3.1 Cause 

Liquid overflow can be caused by liquid input in excess of 
liquid outlet capacity. This may be the result of failure of an 
upstream flow rate control device, failure of the liquid level 
control system, or blockage of a liquid outlet. 

4.2.1.3.2 Effect and Detectable Abnormal 
Condition 

The effects of liquid overflow can be overpressure or 
excess liquids in a downstream component, or release of 
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hydrocarbons to the atmosphere. High level is the detectable 
abnormal condition that indicates that overflow may occur. 

4.2.1 .3.3 Primary Protection 

Primary protection from liquid overflow should be provided 
by an LSH sensor to shut off inflow into the component. 

4.2.1 .3.4 Secondary Protection 

Secondary protection from liquid overflow to the atmo- 
sphere should be provided by the Emergency Support Sys- 
tems. Secondary protection from liquid overflow to a 
downstream component should be provided by safety devices 
on the downstream component. 

4.2.1 .3.5 Location of Safety Devices 

The LSH sensor should be located a sufficient distance 
above the highest operating liquid level of a component to 
prevent nuisance shutdowns, but with adequate volume above 
the LSH sensor to prevent liquid overflow before shutdown is 
accomplished. 

4.2.1.4 Gas Blowby 

Gas blowby is the discharge of gas from a process compo- 
nent through a liquid outlet. 

4.2.1.4.1 Cause 

Gas blowby can be caused by failure of a liquid level con- 
trol system or inadvertent opening of a bypass valve around a 
level control valve. 

4.2.1 .4.2 Effect and Detectable Abnormal 
Condition 

The effect of gas blowby can be overpressure in a down- 
stream component. Low level is the detectable abnormal con- 
dition that indicates gas blowby may occur. 

4.2.1 .4.3 Primary Protection 

Primary protection from gas blowby should be provided by 
an LSL sensor to shut off inflow or shut off the liquid outlet. 

4.2.1 .4.4 Secondary Protection 

Secondary protection from gas blowby to a downstream 
component should be provided by safety devices on the 
downstream component. 

4.2.1 .4.5 Location of Safety Devices 

The LSL sensor should be located a sufficient distance 
below the lowest operating liquid level to avoid nuisance 



shutdowns, but with an adequate volume between the LSL 
sensor and liquid outlet to prevent gas blowby before shut- 
down is accomplished. 

4.2.1 .5 Underpressure 

Underpressure is pressure in a process component less than 
the design collapse pressure. 

4.2.1.5.1 Cause 

Underpressure can be caused by fluid withdrawal in 
excess of inflow that may be the result of failure of an inlet 
or outlet control valve, blockage of an inlet line during 
withdrawal, or thermal contraction of fluids when the 
inlets and outlets are closed. 

4.2.1 .5.2 Effect and Detectable Abnormal 
Condition 

The effect of underpressure can be collapse of the compo- 
nent and a leak. Low pressure is the detectable abnormal con- 
dition that indicates underpressure may occur. 

4.2.1 .5.3 Primary Protection 

Primary protection from underpressure in an atmospheric 
component should be provided by an adequate vent system. 
Primary protection for a pressure component subject to 
underpressure should be provided by a gas makeup system. 

4.2.1 .5.4 Secondary Protection 

Secondary protection for an atmospheric component 
should be provided by a second vent or by a PSV. Secondary 
protection for a pressure component subject to underpressure 
should be provided by a PSL sensor to shut off inflow and 
outflow. 

4.2.1 .5.5 Location of Safety Devices 

The PSL sensor should be installed at the highest practical 
location on the component to minimize the chances of fouling 
by flow stream contaminants. Vents and PSVs should be 
installed in accordance with API Standard 2000 or other 
applicable standards. 

4.2.1 .6 Excess Temperature (Fired and Exhaust 
Heated Components) 

Excess temperature is temperature above that in which a 
process component is designed to operate. This undesirable 
event in fired and exhaust heated components is categorized 
as excess medium or process fluid temperature and excess 
stack temperature. Excess temperature in unfired components 
is discussed in individual component analyses in Appendix A. 
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4.2.1.6.1 Cause 

Excess medium or process fluid temperature can be caused 
by excess fuel or heat input due to failure or inadvertent 
bypassing of the fuel or exhaust gas control equipment, extra- 
neous fuel entering the firing chamber through the air intake, 
or a leak of combustible fluids into the fired or exhaust heated 
chamber; insufficient volume of heat transfer fluid due to low 
flow in a closed heat transfer system (where the heated 
medium is circulated through tubes located in the firing or 
exhaust heated chamber); or low liquid level in a fired com- 
ponent with an immersed fire or exhaust gas tube. Excess 
stack temperature in a fired component can be caused by any 
of the above or by insufficient transfer of heat because of 
accumulation of foreign material (sand, scale, etc.) in the heat 
transfer section. Excess stack temperature in an exhaust 
heated component can result from ignition of a combustible 
medium leak into the exhaust heated chamber. 

4.2.1 .6.2 Effect and Detectable Abnormal 
Condition 

The effects of high medium or process fluid temperature 
can be a reduction of the working pressure and subsequent 
leak or rupture of the affected component and/or overpressure 
of the circulating tubes in a closed heat transfer system, if the 
medium is isolated in the tubes. The effect of high stack tem- 
perature can be a direct ignition source for combustibles com- 
ing in contact with the stack surface. High temperature, low 
flow, and low level are the detectable abnormal conditions 
that indicate that excess temperature may occur. 

4.2.1.6.3 Primary Protection 

Primary protection from excess medium or process fluid 
temperature resulting from excess or extraneous fuel, heat, or 
medium leaks into the fired or heated chamber should be pro- 
vided by aTSH sensor. If caused by low liquid level, protec- 
tion should be provided by an LSL sensor. The TSH and LSL 
sensors on fired components should shut off fuel supply and 
inflow of combustible fluids. The TSH and LSL sensors on 
exhaust heated components should divert or shut off the fuel 
or heat source. If excess medium temperature is due to low 
flow in a closed heat transfer system containing combustible 
fluid, primary protection should be provided by an FSL sen- 
sor to shut off fuel supply to a fired component or to divert the 
exhaust flow from an exhaust heated component. Primary 
protection from excess stack temperature should be provided 
by a TSH (stack) sensor to shut off the fuel or exhaust gas 
source and inflow of combustible fluids. 

4.2.1 .6.4 Secondary Protection 

Secondary protection from excess medium or process fluid 
temperature in a fired component, if caused by excess or 
extraneous fuel, should be provided by a TSH (stack) sensor, 



and, if caused by low flow, by a TSH (medium) sensor and 
TSH (stack) sensor. If caused by low level, secondary protec- 
tion should be provided by a TSH (medium or process fluid) 
sensor and TSH (stack) sensor. Secondary protection from 
excess medium or process fluid temperature in an exhaust 
heated component, if caused by low level or low flow, should 
be provided by a TSH (medium) sensor. These TSH sensors 
should perform the same function as the primary protection. 
Secondary protection for excess stack temperature should be 
provided by the Emergency Support Systems and an FSV, 
where applicable. 

4.2.1.6.5 Location of Safety Devices 

Temperature sensors, other than fusible or skin contact 
types, should be placed in a thermowell for ease of removing 
and testing. In a two-phase (gas/liquid) system the TSH sen- 
sor should be located in the liquid section. In a tube-type 
heater, where the heated medium flows through tubes located 
in the firing or heating chamber, the TSH sensor should be 
located in the tube outlet as close as is practical to the heater. 
An FSV should be installed on medium tube outlet piping. 

4.2.1.7 Direct Ignition Source (Fired Components) 

A direct ignition source is an exposed surface, flame, or 
spark at sufficient temperature and heat capacity to ignite 
combustibles. Direct ignition sources discussed in this para- 
graph are limited to fired components. Electrical systems and 
other ignition sources are discussed in 4.2.3. 

4.2.1.7.1 Cause 

Direct ignition sources can be caused by flame emission 
from the air intake due to the use of improper fuel (e.g., liquid 
carryover in a gas burner), reverse draft from a natural draft 
burner, or extraneous fuel entering the air intake; spark emis- 
sion from the exhaust stack; or hot surfaces resulting from 
excess temperature. 

4.2.1 .7.2 Effect and Detectable Abnormal 
Condition 

The effect of a direct ignition source can be a fire or explo- 
sion if contacted by a combustible material. High temperature 
and low air flow (forced draft burners only) are the detectable 
abnormal conditions that indicate a direct ignition source may 
occur. 

4.2.1.7.3 Primary Protection 

Primary protection from flame emission through the air 
intake of a natural draft burner should be provided by a flame 
arrestor to contain the flame in the firing chamber. Primary 
protection from flame emission through the air intake of a 
forced draft burner should be provided by a PSL (air intake) 
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sensor to detect low air flow and shut off the fuel and air sup- 
ply. A stack attestor should provide primary protection from 
exhaust stack spark emission. Primary protection from hot 
surfaces due to excess temperature should be provided by a 
TSH (medium or process fluid) sensor and TSH (stack) sen- 
sor. The TSH sensor should shut off fuel supply and inflow of 
combustible fluids. 

4.2.1 .7.4 Secondary Protection 

Secondary protection from flame emission through the air 
intake of a natural draft burner should be provided by the 
emergency support system. Secondary protection from flame 
emission through the air intake of a forced draft burner should 
be provided by a blower motor interlock to detect blower 
motor failure and to initiate a signal to shut off the fuel and air 
supply. Secondary protection from exhaust stack spark emis- 
sion and hot surfaces should be provided by the Emergency 
Support Systems and an FSV where applicable. 

4.2.1.7.5 Location of Safety Devices 

The location of air intake flame arrestors and exhaust stack 
spark arrestors is fixed. These items should be installed to 
facilitate inspecting and cleaning. TSH (stack, media, process 
fluids) sensors should be installed as discussed in 4.2.1.6. A 
PSL (air intake) sensor should be installed downstream of the 
blower fan inside the air intake on a forced draft burner. 
Forced draft burners should have starter interlocks installed 
on the blower motor starter. An FSV should also be installed 
in medium tube outlet piping. 

4.2.1.8 Excess Combustible Vapors in the Firing 
Chamber (Fired Component) 

Excess combustible vapors in the firing chamber are com- 
bustible vapors in addition to those required for normal igni- 
tion of either the pilot or main burner. 

4.2.1.8.1 Cause 

Accumulation of excess combustible vapors in the firing 
chamber can be caused by a failure of the fuel or air supply 
control equipment or improper operating procedures. 

4.2.1 .8.2 Effect and Detectable Abnormal 
Condition 

The effect of excess combustible vapors in the firing cham- 
ber, on ignition, could be an explosion and possible rupture of 
the component. Flame failure and high or low fuel supply 
pressure are detectable abnormal conditions that could indi- 
cate excess combustible vapors in the firing chamber. Low air 
supply pressure and blower failure may also indicate this con- 
dition in forced draft burners. 



4.2.1 .8.3 Primary Protection 

Primary protection from excess combustible vapors in the 
firing chamber caused by a mechanical failure of the fuel con- 
trol equipment should be provided by a flame failure sensor. 
The sensor should detect a flame insufficient to ignite the 
entering vapors and shut off the fuel. The sensor may be the 
light detecting type (BSL), such as an ultraviolet detector, or 
the heat sensing type (TSL). 

4.2.1 .8.4 Secondary Protection 

Secondary protection from excess combustible vapors in 
the firing chamber due to fuel control failure should be pro- 
vided by a PSH (fuel) sensor to shut off the fuel On a forced 
draft burner, a PSL sensor should be installed on the fuel sup- 
ply; also, a PSL (air) sensor and motor starter interlock 
should be installed to detect an inadequate air supply and ini- 
tiate a signal to shut off the fuel and air. An FSL sensor may 
be installed in place of a PSL sensor in the air intake to sense 
low air flow. In addition to the above safety devices, safe 
operating procedures should also be followed to prevent fire- 
box explosions during ignition of the pilot or main burner. 
Recommended safe operating procedures are shown in 
Appendix A, Table A-6.3. 

4.2.1 .8.5 Location of Safety Devices 

A BSL or TSL sensor should be installed in the firing 
chamber to monitor the pilot and/or main burner flame. PSH 
and PSL sensors in the fuel supply should be installed down- 
stream of ail fuel pressure regulators. A PSL (air intake) sen- 
sor should be installed in the air intake downstream of the 
forced draft blower. 

4.2.2 Safety Device Selection 

The required safety device protection is categorized into 
primary and secondary protective devices. The primary 
device will react sooner, safer, or more reliably than the sec- 
ondary device. The primary device will provide the highest 
order of protection and the secondary device should provide 
the next highest order of protection. 

a, A single safety device may not provide complete primary 
or secondary protection because the results of a failure may 
vary by degree or sequence. Thus, several devices or systems 
may be shown, the combination of which will provide the 
necessary level of protection. For example, a PSL sensor and 
an FSV may be required to stop flow to a leak. These two 
devices would provide the primary level of protection. 

b. The protection devices determined in the SAT, in conjunc- 
tion with necessary SDVs or other final control devices, pro- 
tect the process component in any process configuration. It is 
important that the user understand the SAT logic and how the 
SATs are developed. 
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c. The location of SDVs and other final control devices must 
be determined from a study of the detailed flow schematic 
and from a knowledge of operating parameters. When an 
undesirable event is detected in a process component the 
component can be isolated from all input process fluids, heat, 
and fuel, by either shutting in the sources of input or diverting 
the inputs to other components where they can be safely han- 
dled. If the process input is to be shut in, it is preferably done 
at the primary source. 

d. All safety devices shown in the figures in Appendix A for 
each component would be considered and would be installed 
unless conditions exist whereby the function normally per- 
formed by a safety device is not required or is performed ade- 
quately by another safety device(s). The Safety Analysis 
Checklists (SACs) in Appendix A list equivalent protection 
methods, thereby allowing the exclusion of some devices. 

e. If a process component is used that is not covered in 
Appendix A, an SAT for that component would be developed 
as discussed in (a) and (b) above. 

4.2.3 Protective Shut-in Action 

When an abnormal condition is detected in a process com- 
ponent by a safety device or by personnel, all input sources of 
process fluids, heat, and fuel should be shut off or diverted to 
other components where they can be safely handled. If shut- 
off is selected, process inputs should be shut off at the pri- 
mary source of energy (wells, pump, compressor, etc.). It is 
not advisable to close the process inlet to a component if this 
could create an abnormal condition in the upstream compo- 
nent, causing its safety devices to shut it in. This would be 
repeated for each component back through the process until 
the primary source is shut in. Each component would there- 
fore be subjected to abnormal conditions and must be pro- 
tected by its safety devices every time a downstream 
component shuts in. This cascading effect depends on the 
operation of several additional safety devices and may place 
undue stress on the equipment. 

a. It may be desirable to shut in the inlet to a process compo- 
nent for additional protection or to prevent upstream 
components from equalizing pressure or liquid levels after the 
primary source is shut in. If this is desirable, the primary 
source of energy should be shut in simultaneously with or 
prior to closing of the component inlet valve. 

b. There may be special cases where shut in by cascading is 
acceptable. As examples: 

1. The source of input to a separator is frequently 
changed as wells are periodically switched into the sepa- 
rator. If the well(s) producing to the separator is to be 
directly shut in when an abnormal condition is detected, 
the safety system logic must be changed each time differ- 
ent wells are switched into the unit. This creates the 
possibility of oversight in changing the logic. In this case, 
it may be preferable to close the separator inlet, and let the 



resulting high flowline pressure cause the well(s) to shut 
in by action of the flow line PSH sensor. The header and 
the flow line should be rated for the maximum pressure 
that could be caused by this action. 

2. A platform receives production through a flow line 
from a satellite well. Although the source of energy to the 
system is the satellite well, detection of an abnormal con- 
dition on the platform should cause activation of an SDV 
on the incoming flowline. If it is desired to shut in the sat- 
ellite well following closure of the flow line SDV at the 
platform, this may be accomplished by use of a flow line 
PSH sensor installed at the satellite location. 

3. A compressor installation is equipped with an auto- 
matic divert valve that permits production to be 
maintained from wells capable of producing against pipe- 
line pressure when a compressor shut down occurs. In this 
case, wells incapable of producing against pipeline pres- 
sure may be shut in by action of the individual flow line 
PSH sensors to minimize potential safety system logic 
problems as discussed in (a) above. 

4.2.4 Ignition Preventing Measures 

The Safety Flow Chart shown in Figure 3-1 illustrates that 
the principal threat to platform safety is the release of hydro- 
carbons. However, if ignition of released hydrocarbons can be 
prevented, the consequences of the hydrocarbon release can 
be reduced. Thus, prevention of ignition is another protection 
method that must be considered along with safety devices and 
Emergency Support Systems. Ignition of hydrocarbons could 
be caused by electric arcs, flame, sparks, and hot surfaces. 
Protection from these sources is provided by design consider- 
ations that decrease the possibility of hydrocarbons contact- 
ing an ignition source or preventing gaseous hydrocarbons 
from reaching a combustible concentration. Collectively, 
these methods are referred to in this recommended practice as 
"Ignition Preventing Measures" (IPM) and include: (a) venti- 
lation, (b) application of electrical codes and recommended 
practice, (c) location of potential ignition sources, and (d) 
protection of hot surfaces. 

4.2.4.1 Ventilation 

Ignition of a combustible gas requires that the concentra- 
tion of the gas mixed with air (oxygen) reaches the lower 
explosive limit (LEL). The safety system is designed to mini- 
mize the amount of hydrocarbon released by shutting off the 
hydrocarbon source on detecting an abnormal condition. 
Another method for preventing a combustible mixture is to 
provide a volume of air sufficient to maintain the hydrocar- 
bon concentration below the LEL. To prevent the accumula- 
tion of combustible mixtures, process areas should be as open 
as practicable to allow the free movement of air. Enclosed 
areas containing hydrocarbon handling or fueled equipment 
should have adequate ventilation so that the gases or vapors 
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will dissipate before reaching the LEL. If adequate ventila- 
tion is not provided for enclosed areas, a combustible gas 
detector (ASH) should be installed to initiate a signal at a pre- 
set concentration below the LEL to shut off the hydrocarbon 
source. 

4.2.4.2 Electrical Codes and Recommended 
Practices 

Protection from ignition by electrical sources should be 
provided by designing and maintaining electrical equipment 
in accordance with API Recommended Practice 14F or other 
applicable standards, and by classification of platform areas 
according to API Recommended Practice 500. 

a. API Recommended Practice 14F defines criteria for elec- 
trical equipment and wiring methods that can be used safely 
in classified and unclassified areas on offshore production 
platforms. 

b. API Recommended Practice 500 presents methods for 
classifying areas surrounding drilling rigs and production 
facilities on land and on marine fixed and mobile platforms 
for safe installation of electrical equipment. 

4.2.4.3 Location 

Potential ignition sources, such as fired process compo- 
nents and certain rotating machinery, are normally equipped 
to minimize the possibility of igniting released hydrocarbons. 
Additional protection can be provided by locating equipment 
in areas where exposure to inadvertently released hydrocar- 
bons is minimized. API Recommended Practice 14J provides 
guidance for locating equipment. Some other potential igni- 
tion sources are those related to housekeeping such as boilers, 
water heaters, stoves, clothes dryers, etc. These should be 
located in electrically unclassified areas. If such equipment is 
gas fueled and installed in an inadequately ventilated build- 
ing, a combustible gas detector (ASH) should be installed to 
close fuel shutdown valves located outside the building. 

4.2.4.4 Hot Surface Protection 

Any surface with a temperature in excess of 400°F (204°C) 
should be protected from exposure to hydrocarbon liquids 
due to spillage or leakage. Surfaces with a temperature in 
excess of 725 °F (385 °C) (approximately 80 percent of the 
ignition temperature of natural gas) should be protected from 
exposure to accumulations of combustible gases and vapors. 
Methods of protection can be insulation, barriers, water cool- 
ing, etc. However, if such surfaces on permanent or portable 
equipment are in an area classified by API Recommended 
Practice 500, they should be insulated. Some mechanical 
components such as turbochargers, exhaust manifolds and the 
like (including associated piping) that cannot be insulated 
without causing mechanical failure should be protected by 
other means. 



4.2.5 Hot Equipment Shielding 

Any surface with a temperature in excess of 160°F (71°C) 
should have protection when accidental contact of the hot sur- 
face could be made by personnel within normal work or walk 
areas. Protection may be in the form of guards, barriers, or 
insulation. Some mechanical components such as turbocharg- 
ers, exhaust manifolds, compressor heads, expansion bottles, 
and the like (including associated piping) are exceptions; in 
these cases, warning signs are acceptable. 

4.2.6 Emergency Support Systems (ESS) 

The Emergency Support Systems (discussed in detail in 
Appendix C) minimize the effects of escaped hydrocarbons 
on offshore production platforms. The ESS includes: 

a. The combustible gas detection system to sense the pres- 
ence of escaped hydrocarbons and initiate alarms and 
platform shutdown before gas concentrations reach the LEL. 

b. The containment system to collect escaped liquid hydro- 
carbons and initiate platform shutdown. 

c. The fire loop system to sense the heat of a fire and initiate 
platform shutdown. 

d. Other fire detection devices (flame, thermal, and smoke) 
that are used to enhance fire detection capability. 

e. The Emergency Shutdown System to provide a method to 
manually initiate platform shutdown by personnel observing 
abnormal conditions or undesirable events. 

f. The SSSVs that may be self actuated (SSCSV) or acti- 
vated by an ESD system and/or a fire loop (SCSSV). 

4.2.7 Other Support Systems 

The integrity of a platform surface safety system depends 
on proper operation of several other support systems. These 
ancillary support systems carry the same degree of impor- 
tance as other portions of the platform safety system and 
should be equally as well maintained. Those discussed in 
Appendix C are the pneumatic supply system and systems for 
discharging gas to the atmosphere. 

a. The pneumatic supply system is installed to provide power 
for actuators and supply for instruments. 

b. Systems for discharging gas to the atmosphere are 
installed to provide a means for conducting discharged gas 
from process components to safe locations for final release to 
the atmosphere. 

4.3 SAFETY ANALYSIS 

4.3.1 Safety Analysis Table (SAT) 

Safety Analysis Tables (SATs) for the basic process com- 
ponents of a platform production facility are presented in 
Appendix A. The SATs are applicable to a component regard- 
less of its position in the process flow. The boundaries of each 
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process component include the inlet piping, control devices, 
and the outlet piping to another component. Every outlet pipe 
and pipe branch should be included up to the point where 
safety devices on the next component provide protection. 

a. The safety analysis of each process component highlights 
undesirable events (effects of equipment failures, process 
upsets, accidents, etc.) from which protection should be pro- 
vided, along with detectable abnormal conditions that can be 
monitored for safety surveillance. These detectable condi- 
tions are used to initiate action through automatic controls to 
prevent or minimize the effect of undesirable events. The 
tables present the logical sequence of safety system develop- 
ment, including undesirable events that could be created in 
downstream process components because of failures in the 
equipment or safety devices of the component under 
consideration. 

b. The generic causes of each undesirable event are listed. 
The primary causes are equipment failures, process upsets, 
and accidental, but all primary causes in a category will create 
the same undesirable event. Thus, a blocked line could be due 
to plugging, freezing, or other failure of a control valve, or the 
inadvertent closing of a manual valve. The undesirable events 
should be determined from a detailed investigation of the fail- 
ure modes of the component and its ancillary equipment. 
These failure modes are grouped under causes, according to 
the manner in which they may generate the undesirable event. 

c. The protective safety devices and Emergency Support 
Systems that prevent or react to minimize the effects of unde- 
sirable events should be designed in accordance with 4.2. 

4.3.2 Safety Analysis Checklist (SAC) 

Table B-l is a composite SAC for normally used process 
components. Individual SACs are shown in Appendix A as an 
aid for discussing the application of the safety analysis to 
each individual component. The SAC lists the safety devices 
that would be required to protect each process component if it 
were viewed as an individual unit with the worst probable 
input and output conditions. Listed under each recommended 
device are certain conditions that eliminate the need for that 
particular device when the component is viewed in relation to 
other process components. This action is justified because 
safety devices on other components will provide the same 
protection, or because in a specific configuration, the abnor- 
mal condition that the device detects will not lead to a threat 
to safety. 

4.3.3 Safety Analysis Function Evaluation (SAFE) 
Chart 

The Safety Analysis Function Evaluation (SAFE) chart, 
shown in Figure B-l, is used to relate all sensing devices, 
SDVs, shutdown devices, and emergency support systems to 



their functions. The SAFE chart should list all process com- 
ponents and Emergency Support Systems with their required 
safety devices, and should list the functions to be performed 
by each device. If the device is not needed, the reason should 
be listed on SAFE by referring to the appropriate SAC item 
number. If the reason for eliminating a device is that a device 
on another component provides equivalent protection, this 
alternate device should also be shown on SAFE. The relation 
of each safety device with its required function can be docu- 
mented by checking the appropriate box in the chart matrix. 
Completion of the SAFE chart provides a means of verifying 
the design logic of the basic safety system. 

4.4 ANALYSIS AND DESIGN PROCEDURE 
SUMMARY 

The analysis and design of a platform surface safety sys- 
tem should include the following steps: 

a. Describe the process by a detailed flow schematic and 
establish the operating parameters. The flow schematic and 
operating parameters should be developed based on equip- 
ment design and process requirements. 

b. From the Safety Analysis Tables (SATs), verify the need 
for basic safety devices to protect each process component 
viewed as an individual unit. The Safety Analysis Checklist 
(SAC) for individual components is then used to justify the 
elimination of any safety device when each process compo- 
nent is analyzed in relation to other process components. The 
SAC lists specific conditions under which some safety 
devices may be eliminated when larger segments of the pro- 
cess are considered. 

c. If a process component significantly different from those 
covered in this recommended practice is used in a process, an 
SAT and an SAC table should be developed for that compo- 
nent. 

d. Using the Safety Analysis Function Evaluation (SAFE) 
chart, logically integrate all safety devices and self-protected 
equipment into a complete platform safety system. List on 
SAFE all process components and their required safety 
devices. Enter the functions the devices perform and relate 
each device to its function by checking the appropriate box in 
the chart matrix. 

e. If designing a new facility, show all devices to be installed 
on the process flow schematic. 

f. If analyzing an existing facility, compare SAFE with the 
process flow schematic and add the devices required but not 
shown. 

The analyses should define the monitoring devices (sen- 
sors) and self-actuating safety devices needed for a process 
facility. They also establish the safety function required (shut- 
down, diverting the input, pressure relief, etc.). 
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Appendix A presents a complete safety analysis of each 
basic process component normally used in a platform produc- 
tion process system. The component analysis includes the fol- 
lowing: 

a. A description of each process component. 

b. A typical drawing of each process component showing all 
recommended safety devices that should be considered based 
on individual component analysis. A discussion of each pro- 
cess component is included outlining recommended safety 
device locations. 

c. A safety analysis table (SAT) for each process component 
analyzing the undesirable events that could affect the compo- 
nent. 

d. A safety analysis checklist (SAC) for each process compo- 
nent listing all recommended safety devices and showing 
conditions under which particular safety devices may be 
excluded. A discussion of the rationale for including or 
excluding each safety device is presented. 

A.1 Wellheads and Flow Lines 

A.1.1 DESCRIPTION 

Wellheads furnish surface control (manual and automatic) 
and containment of well fluids and provide downhole access 
for well servicing. Flow lines transport hydrocarbons from 
the wellhead to the first downstream process component. 

For analysis purposes and assignment of safety devices, 
flow lines are divided into flow line segments. A flow line 
segment is any portion of a flow line that has an assigned 
operating pressure different from other portions of the same 
flow line. These flow line segments can be classified as either 
initial (beginning at wellhead), intermediate, or final (termi- 
nating at another process component) segments. Thus, a flow 
line that experiences a reduction in operating pressure due to 
some inline pressure reducing device, such as a choke, and 
has two different assigned operating pressures, will have an 
initial and final segment. A flow line that experiences no 
reduction in operating pressure due to a pressure reducing 
device will have only one segment. In this case, the initial and 
final flow line segment will be the same. Each flow line seg- 
ment must be analyzed to determine appropriate safety 
devices. Recommended safety devices for typical wellheads 
and flow lines are shown in Figures A-l. 1, A-l .2, and A-l .3. 

A.1 .2 SAFETY ANALYSIS 

A.1 .2.1 Safety Analysis Table 

The Safety Analysis Table (SAT) for a flow line segment is 
presented in SAT Table A-l.l. The undesirable events that 
can affect a flow line segment are overpressure and leak. 



A.1 .2.2 Safety Analysis Checklist 

The Safety Analysis Checklist (SAC) for a flow line seg- 
ment is presented in SAC Table A- 1 .2. 

A.1 .2.2.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

Because wells are the primary source of pressure, a PSH 
sensor to shut in the well should always be provided on each 
flow line to detect abnormally high pressure. A PSH sensor to 
shut in the well should be installed on the final flow line seg- 
ment and on any other segment that has a maximum allow- 
able working pressure less than the maximum shut in tubing 
pressure of the well. A PSL sensor to shut in the well should 
be provided on each flow line segment, except the initial seg- 
ment if the first choking device is less than 1.0 feet (3m) from 
the wellhead or, in the case of an underwater installation, rea- 
sonably close to that distance. A PSV is not required if the 
maximum allowable working pressure of a flow line segment 
is greater than the maximum shut in tubing pressure of the 
well, or if the segment is protected by a PSV located on an 
upstream flow line segment. An SDV (in addition to the SSV) 
with an independent PSH sensor connected to a separate relay 
and sensing point is an acceptable alternate to a PSV, provid- 
ing the flow line volume upstream of block valves is adequate 
to allow sufficient time for the SDVs to close before exceed- 
ing the maximum allowable working pressure. This alterna- 
tive should be approached with caution after thorough 
consideration of other alternatives. In some cases, installation 
of a PSV in addition to two SDVs might be desirable even at 
locations having no containment system. 

A.1 .2.2.2 Flow Safety Device (FSV) 

A check valve (FSV) is only necessary in the final flow line 
segment to minimize backflow to the flow line. 

A.1 .3 SAFETY DEVICE LOCATION 

The recommended location for safety devices is given in 
A.1.3.1-A.1.3.3. 

A.1 .3.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

The PSH and PSL sensors should be located for protection 
from damage due to vibration, shock, and accidents. The 
sensing point should be located on top of a horizontal run or 
in a vertical run. An independent sensing point should be pro- 
vided for a second PSH used with an SDV as alternate protec- 
tion for a PSV The PSV should be located upstream of the 
first blocking device in the flow line segment and should not 
be set higher than the rated working pressure of the segment. 
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A.1 .3.2 Flow Safety Device (FSV) 

The check valve (FSV) should be located in the final 
flow line segment so that the entire flow line is protected 
from backflow. 

A.1 .3.3 Shutdown Devices (SSV or USV) 

The SSV should be located on the wellhead as the sec- 
ond valve in the flow stream from the wellbore. The SSV 
should be actuated by the flow line pressure sensors, ESD 
system, fire loop system, and sensors on downstream pro- 



cess components. An SDV (in addition to the SSV) may be 
installed on the wellhead. If an SDV is installed, it may be 
actuated, in lieu of the SSV, by the flow line pressure sen- 
sors and sensors on downstream process components. The 
USV should be in a practical location in the wellhead 
flowstream and within a reasonable proximity of the well- 
bore. The USV should be actuated by the flow line pres- 
sure sensors located upstream of any SDV, by the ESD 
system, and by the fire loop system. The SSV is optional 
on subsea installations equipped with USVs. 
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Figure A-1.1 — Recommended Safety Devices — Wellhead Flow Lines 
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Figure A-1 .2— Recommended Safety Devices— Underwater Wellhead Flow Lines 
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Table A-1 .1 — Safety Analysis Table (SAT) — Flow Line Segment 



Undesirable Event 



Cause 



Detectable Abnormal 
Condition at Component 



Overpressure 



Blocked or restricted line 
Downstream choke plugged 
Hydrate plug 

Upstream flow control failure 
Changing well conditions 
Closed outlet valve 



High pressure 



Leak 



Deterioration 
Erosion 
Corrosion 
Impact damage 
Vibration 



Low pressure 



Table A-1 .2— Safety Analysis Checklist (SAC) — Flow Line Segment 

High Pressure Sensor (PSH). 

1. PSH installed. 

2. Flow line segment has a maximum allowable working pressure greater than maximum shut in pressure and 
is protected by a PSH on a downstream flow line segment. 

Low Pressure Sensor (PSL). 

1. PSL installed. 

2. Plow line segment is between the well and the first choking device and is less than 1 feet (3 m) in length or, 
in the case of an underwater installation, reasonably close to that distance. 

Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Flow line segment has a maximum allowable working pressure greater than the maximum shut in pressure. 

3. Two SDVs (one of which may be the SSV) with independent PSHs, relays, and sensing points are installed 
where there is adequate flow line volume upstream of any block valves to allow sufficient time for the SDVs to 
close before exceeding the maximum allowable working pressure. 

4. Flow line segment is protected by a PSV on upstream segment. 

5. Flow line segment is protected by a PSV on downstream component that cannot be isolated from the flow 
line segment and there arc no chokes or other restrictions between the flow line segment and the PSV. 

Flow safety Valve (FSV). 

1. FSV installed. 

2. Flow line segment is protected by FSV in final flow line segment. 



A.2 Wellhead Injection Lines 

A.2.1 DESCRIPTION 

Injection lines transfer fluids to the wellbore for artificial 
lift or reservoir injection. Recommended safety devices for 
typical wellhead injection lines are shown in Figure A-2. 

A.2.2 SAFETY ANALYSIS 

A.2.2.1 Saftey Analysis Table 

The Safety Analysis Table (SAT) for wellhead injection 
lines is presented in SAT Table A-2.1. The undesirable events 
that can affect an injection line are overpressure and leak. 

A.2.2.2 Safety Analysis Checklist 

The Safety Analysis Checklist (SAC) for wellhead injec- 
tion lines is presented in SAC Table A-2. 2. 



A.2.2.2.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

Pressure protection is usually provided by a PSH and a 
PSL sensor on the injection source, such as a compressor or 
pump, to shut off inflow. If the PSH and PSL sensors also 
protect the injection line, wellhead, and other equipment, 
these devices are not required on the injection line. A PSV is 
not necessary if the injection line is designed to withstand the 
maximum pressure that can be imposed by the injection 
source. Usually, a PSV is provided on the injection source 
that will also protect the injection line, wellhead, and other 
equipment. 

A.2.2.2.2 Flow Safety Device (FSV) 

A check valve (FSV) should be provided on each injection 
line to minimize backflow. 
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A.2.3 SAFETY DEVICE LOCATION 

The recommended location for safety devices is given in 
A.2.3. 1 -A.3.3. 

A.2.3.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

The PSH and PSL sensors should be located upstream of 
the FS V, and the sensing point should be on top of a horizon- 
tal run or in a vertical run. The PSV should be located so that 
it cannot be isolated from any portion of the injection line. 

A.2.3.2 Flow Safety Device (FSV) 



A.2.3.3 Shutdown Devices (SDV) 

Injection line SDVs should be located as near the wellhead 
as is practical to minimize the amount of line exposed. SDVs 
are not required on gas lift lines if they are protected at an 
upstream component and if they are not subject to backflow 
from the producing formation. Also, an SDV is not required if 
the injection line is for the purpose of injecting water and the 
subsurface formation is incapable of backflowing hydrocar- 
bons. If closing an SDV could cause rapid pressure buildup in 
the injection line, consideration should be given to shutdown 
of the injection source and/or use of a second FSV in lieu of 
an SDV. 



The check valve (FSV) should be located on each injection 
line as near the wellhead as is practical so that the entire line 
is protected from backflow. 
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Figure A-2 — Recommended Safety Devices — Wellhead Injection Lines 
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Table A-2.1— Safety Analysis Table (SAT) — Wellhead Injection Lines 



Undesirable Event 



Cause 



Detectable Abnormal Condition at 
Component 



Overpressure Blocked or restricted outlet High pressure 

Hydrate plug 
Upstream control failure 
Plugged formation 
Leak Deterioration Low pressure 

Erosion 
Corrosion 
Impact damage 
Vibration 

Table A-2. 2— Safety Analysis Checklist (SAC) — Wellhead Injection Lines 

a. High Pcssurc Sensor (PSH). 

1. PSH installed. 

2. Line and equipment are protected by an upstream PSH. 

b. Low Pressure Sensor (PSL). 

i. PSL installed. 

2. Line and equipment arc protected by an upstream PSL. 

c. Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Line and equipment have a maximum allowable working pressure greater than the maximum pressure that 
can be imposed by the injection source. 

3. Line and equipment arc protected by an upstream PSV. 

d. Check Valves (FSV). 

I. FSV(s) installed. 



A.3 Headers 

A.3.1 DESCRIPTION 

Headers receive production from two or more flow streams 
and distribute production to the required process systems, 
such as the low, intermediate, or high pressure production and 
test separation facilities. Recommended safety devices for 
typical headers are shown in Figure A-3. 

A.3.2 SAFETY ANALYSIS 

a. The Safety Analysis Table (SAT) for headers is pre- 
sented in SAT Table A-3.1. The undesirable events that can 
affect a header are overpressure and leak. 

b. The Safety Analysis Checklist (SAC) for headers is pre- 
sented in SAC Table A-3. 2. 

A.3.2.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

PSH and PSL sensors are not required on headers if each 
input source is equipped with a PSH and a PSL sensor and the 
PSH sensor is set less than the rated working pressure of the 
header. Also, a PSH sensor is not required if the header is pro- 
tected by a PSH sensor on a downstream process component 
and the header cannot be isolated from the downstream com- 
ponent. A PSL is not required if the header is for flare, relief, 
vent, or other atmospheric service. If the header requires a 
PSH and a PSL sensor, the signal from each should shut off 
all input sources to the header. 



A PSV is not required on a header if: (a) the maximum 
allowable working pressure is greater than the maximum shut 
in pressure of any connected input source, (b) pressure relief 
protection is provided on all connected input sources that 
have a maximum shut in pressure greater than the maximum 
allowable working pressure of the header, (c) the header is 
protected by a PSV on a downstream process component that 
cannot be isolated from the header, (d) the header is for flare, 
relief, vent, or other atmospheric service and has no valving 
in the outlet piping, or (e) the input source is a well(s) having 
a pressure greater than the maximum allowable working pres- 
sure of the header and is equipped with two SDVs (one of 
which may be the SSV) controlled by independent PSHs con- 
nected to separate relays and sensing points. Other input 
sources having a pressure greater than the maximum allow- 
able working pressure of the header are protected by PS Vs. 
The use of two SDVs in lieu of a PSV should be approached 
with caution after thorough consideration of other alterna- 
tives. In some cases, installation of a PSV in addition to two 
SDVs might be desirable even at locations having no contain- 
ment system. 

A.3.3 SAFETY DEVICE LOCATION 

Pressure Safety Devices, PSH and PSL sensors or a PSV, if 
required, should be located to sense pressure throughout the 
header. If different pressure conditions exist in separate sec- 
tions of the header, each section should have the required pro- 
tection. 
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Figure A-3 — Recommended Safety Devices — Headers 
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Table A-3.1— Safety Analysis Table (SAT)— Headers 



Undesirable Event 



Cause 



Detectable Abnormal Condition at 
Component 



Overpressure Blocked or restricted outlet High pressure 

Hydrate plug 
Upstream control failure 
Excess inflow 
Leak Deterioration Low pressure 

Erosion 
Corrosion 
Impact damage 
Vibration 

Table A-3.2— Safety Analysis Checklist (SAC)— Headers 

a. High Pressure Sensor (PSH). 

L PSH installed. 

2. Each input source is equipped with a PSH set less than the maximum allowable working pressure of the 
header. 

3. Header is protected by downstream PSH that cannot be isolated from the header. 

4. Header is for flare, relief, vent, or other atmospheric service and has no valving in the outlet piping. 

b. Low Pressure Sensor (PSL). 

1. PSL installed. 

2. Each input source is protected by a PSL and there are no pressure control devices or restrictions between the 
PSL and the header. 

3. Header is for flare, relief, vent, or other atmospheric service. 

c. Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Header has a maximum allowable working pressure greater than the maximum shut in pressure of any con- 
nected well. 

3. Pressure relief protection is provided on each input source having a maximum shut in pressure greater than 
the maximum allowable working pressure of the header. 

4. Header is protected by downstream PSV that cannot be isolated from the header. 

5. Header is for flare, relief, vent, or other atmospheric service and has no valving in the outlet piping. 

6. Input source is a wcll(s) having a pressure greater than the maximum allowable working pressure of the 
header and is equipped with two SDVs (one of which may be the SSV) controlled by independent PSHs con- 
nected to separate relays and sensing points. Other input sources having a pressure greater than the maximum 
allowable working pressure of the header arc protected by PS Vs. 



A.4 Pressure Vessels 

A.4.1 DESCRIPTION 

Pressure vessels handle hydrocarbons under pressure for 
liquid-gas separation, dehydration, storage, and surge. Some 
pressure vessel applications require heat input. This discus- 
sion covers only the effects of heat input to the process sec- 
tion of a heated vessel. Heating equipment is covered in A. 6 
and A. 1.0. Pressure vessels associated with compressors, other 
than compressor cylinders should be protected in accordance 
with this section. Compressor cylinders and cases are covered 
in A. 8. Recommended safety devices for typical pressure ves- 
sels are shown in Figure A-4. 

A.4.2 SAFETY ANALYSIS 

A.4.2.1 Safety Analysis Table 

The Safety Analysis Table (SAT) for pressure vessels is 
presented in SAT Table A-4.1. The undesirable events that 



can affect a pressure vessel are overpressure, underpressure, 
overflow, gas blowby, leak, and excess temperature if the ves- 
sel is heated. 

A.4. 2. 2 Safety Analysis Checklist 

The Safety Analysis Checklist (SAC) for pressure vessels 
is presented in SAC Table A-4. 2. 

A.4.2.2.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

a. A pressure vessel that receives fluids from a well or from 
other sources that can cause overpressure should be protected 
by a PSH sensor to shut off inflow to the vessel The PSH sen- 
sor need not be provided on the vessel if a PSH sensor on 
other process components will sense vessel pressure and shut 
off inflow to the vessel, and the PSH sensor cannot be isolated 
from the vessel; or if the vessel the is final scrubber in a flare, 
relief, or vent system and is designed to withstand maximum 
built-up back pressure; or if the vessel operates at atmo- 
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1 . TSE designations arc symbolic and arc not intended to reflect actual location or quantity. 

2. If pressure vessel is heated, TSH should be installed. 

Figure A-4 — Recommended Safety Devices — Pressure Vessel 



spheric pressure and has an adequate vent system. A vessel 
receiving fluids from a well should always be protected by a 
PSH sensor because the pressure potential of a well may 
increase due to changes in reservoir conditions, artificial lift, 
workover activities, etc. 

b. A pressure vessel should be provided with a PSL sensor to 
shut off inflow to the vessel when leaks large enough to 
reduce pressure occur, unless PSL sensors on other compo- 
nents will provide necessary protection and the PSL sensor 
cannot be isolated from the vessel when in service. A PSL 
sensor should not be installed if the vessel normally operates 
at atmospheric pressure or frequently varies to atmospheric 
while in service. In this case, the complexity of lockout 
devices to keep the vessel from shutting in during these oper- 
ating modes could more than offset the protection afforded by 
the PSL sensor. 

c. A pressure vessel should always be protected by one or 
more PSVs with sufficient capacity to discharge maximum 
vessel input rates. At least one PSV should be set no higher 
than the maximum allowable working pressure of the vessel. 
API Recommended Practice 521 may be used as a guide in 
determining set pressures of multiple relief valve installations. 



A PSV need not be provided on a vessel if the vessel is the 
final scrubber in a flare, relief, or vent system; and is designed 
so that back pressure, including inertia! forces, developed at 
maximum instantaneous flow conditions will not exceed the 
working pressure of the lowest pressure rated element; and has 
no internal or external obstructions, such as mist extractors, 
back pressure valves, or flame arrestors. If obstructions exist, a 
PSV, or, as an alternative, a PSE should be installed to bypass 
the restriction. A PSV need not be provided on a vessel if 
PSVs on other process components provide adequate relief 
capacity, relieve at or below vessel maximum allowable work- 
ing pressure, and cannot be isolated from the vessel when in 
service. If such PSVs are located on downstream components, 
they must not be isolated from the vessel at any time. More- 
over, if upstream PSVs provide necessary protection when the 
vessel is in service, but can be isolated when the vessel is shut 
in, a PSV should be installed on the vessel for pressure relief 
due to thermal expansion or fire exposure. 
d. If a pressure vessel is subject to underpressure that could 
cause it to collapse, the vessel should be provided with a gas 
makeup system that will maintain adequate pressure in the 
vessel. 
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Table A-4.1— Safety Analysis Table (SAT) Pressure Vessels 



Undesirable Event 



Cause 



Detectable Abnormal Condition at 
Component 



Overpressure 



Underpressure (vacuum) 



Liquid overflow 



Gas blowby 



Leak 



Excess temperature 



Blocked or restricted outlet 

Inflow exceeds outflow 

Gas blowby (upstream component) 

Pressure control system failure 

Thermal expansion 

Excess heat input 

Withdrawals exceed inflow 

Thermal contraction 

Open outlet 

Pressure control system failure 

Inflow exceeds outflow 

Liquid slug flow 

Blocked or restricted liquid outlet 

Level control system failure 

Liquid withdrawals exceed inflow 

Open liquid outlet 

Level control system failure 

Deterioration 

Erosion 

Corrosion 

Impact damage 

Vibration 

Temperature control system failure 

High inlet temperature 



High pressure 



Low pressure 



High liquid level 



Low liquid level 



Low pressure Low liquid level 



High temperature 



A.4.2.2.2 Level Safety Devices (LSH and LSL) 

A pressure vessel that discharges to flare should be pro- 
tected from liquid overflow by an LSH sensor to shut off 
inflow to the vessel. Vessels that do not discharge to flare 
should also be protected by an LSH sensor unless down- 
stream process components can safely handle maximum liq- 
uids that could overflow. A pressure vessel should be 
protected from gas blowby by an LSL sensor to shut off 
inflow to the vessel or close the liquid outlet. The LSL sensor 
is not required if a liquid level is not maintained in the vessel 
during normal operation, or downstream equipment can 
safely handle gas that could blowby. An LSL sensor to shut 
off the fuel supply should be provided in a heated vessel if the 
heating element is immersed. 

Level devices are not required on pressure vessels that are 
not designed for liquid-gas separation or on small traps from 
which liquids are manually drained. This includes such ves- 
sels as pressure-surge bottles, desanders, gas volume bottles, 
gas meter drip traps, fuel gas filters, etc. 

A.4.2.2.3 Temperature Safety Devices (TSH) 

If a pressure vessel is heated, a TSH sensor should be 
provided to shut off the source of heat when process fluid 
temperature becomes excessive. 



A.4.2.2.4 Flow Safety Devices (FSV) 

A check valve (FSV) should be installed in each gas and 
liquid discharge line if significant fluid volumes could back- 
flow from downstream components in the event of a leak. An 
FSV is not required if a control device in the line will effec- 
tively minimize backflow. Whether backflow is significant is 
a judgement decision. If a line discharges to a pressure vessel 
at a point above the liquid level range, the backflow of liquids 
should be insignificant. Whether or not the gas volume is 
insignificant should depend on the size and pressure of the 
gas section and the conditions where a leak might occur. 

A.4.3 SAFETY DEVICE LOCATION 

The recommended location for safety devices is given in 
AA3.1-AA3A 

A.4.3.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

The PSH and PSL sensors and the PSV should be located to 
sense or relieve pressure from the gas or vapor section of the 
vessel. This is usually on or near the top. However, such 
devices may be located on the gas outlet piping if the pressure 
drop from the vessel to the sensing point is negligible and if the 
devices cannot be isolated from the vessel. Such isolation 
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Table A-4. 2— Safety Analysis Checklist (SAC) — Pressure Vessels 

High Pressure Sensor (PSH). 

1. PSH installed. 

2. Input is from a pump or compressor that cannot develop pressure greater than the maximum allowable work- 
ing pressure of the vessel. 

3. Input source is not a wellhead flow line(s), production header, or pipeline and each input source is protected 
by a PSH that protects the vessel. 

4. Adequately sized piping without block or regulating valves connects gas outlet to downstream equipment 
protected by a PSH that also protects the upstream vessel. 

5. Vessel is final scrubber in a flare, relief, or vent system and is designed to withstand maximum built-up back 
pressure. 

6. Vessel operates at atmospheric pressure and has an adequate vent system. 
Low Pressure Sensor (PSL). 

1. PSL installed. 

2. Minimum operating pressure is atmospheric pressure when in service. 

3. Each input source is protected by a PSL and there arc no pressure control devices or restrictions between the 
PSL(s) and the vessel. 

4. Vessel is scrubber or small trap, is not a process component, and adequate protection is provided by down- 
stream PSL or design function (e.g., vessel is gas scrubber for pneumatic safety system or final scrubber for 
flare, relief, or vent system). 

5. Adequately sized piping without block or regulating valves connects gas outlet to downstream equipment 
protected by a PSL that also protects the upstream vessel. 

Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Each input source is protected by a PSV set no higher than the maximum allowable working pressure of the 
vessel and a PSV is installed on the vessel for fire exposure and thermal expansion. 

3. Each input source is protected by a PSV set no higher than the vessel's maximum allowable working pres- 
sure and at least one of these PSV's cannot be isolated from the vessel. 

4. PSVs on downstream equipment can satisfy relief requirement of the vessel and cannot be isolated from the 
vessel. 

5. Vessel is final scaibbcr in a flare, relief or, vent system, is designed to withstand maximum built-up back 
pressure, and has no internal or external obstructions, such as mist extractors, back pressure valves, or flame 
arrcstors. 

6. Vessel is final scrubber in a flare, relief or, vent system, is designed to withstand maximum built-up back 
pressure, and is equipped with a rupture disk or safety head (PSE) to bypass any internal or external obstruc- 
tions, such as mist extractors, back pressure valves, or flame arrcstors. 

High Level Sensor (LSH). 

1. LSH installed. 

2. Equipment downstream of gas outlet is not a flare or vent system and can safely handle maximum liquid 
carry-over. 

3. Vessel function docs not require handling separated fluid phases. 

4. Vessel is a small trap from which liquids arc manually drained. 
Low Level Sensor (LSL). 

1 . LSL installed to protect each liquid outlet. 

2. Liquid level is not automatically maintained in the vessel, and the vessel docs not have an immersed heating 
clement subject to excess temperature. 

3. Equipment downstream of liquid outlct(s) can safely handle maximum gas rates that can be discharged 
through the liquid outlct(s), and vessel does not have an immersed heating clement subject to excess tempera- 
ture. Restrictions in the discharge linc(s) may be used to limit the gas flow rate. 

Check Valve (FSV). 

1 . FSV installed on each outlet. 

2. The maximum volume of hydrocarbons that could backfiow from downstream equipment is insignificant. 

3. A control device in the line will effectively minimize backfiow. 
High Temperature Sensor (TSH). 

High temperature sensors arc applicable only to vessels having a heat source. 

1. TSH installed. 

2. (Deleted in Second Edition.) 

3. Heat source is incapable of causing excess temperature. 



30 



Analysis, Design, Installation, and Testing of Basic Surface Saftey Systems for Offshore Production Platforms 



could be caused externally (e.g., by blocked valves on gas out- 
let) or internally (e.g., by plugged mist extractors). 

A.4.3.2 Level Safety Devices (LSH and LSL) 

The LSH sensor should be located a sufficient distance 
above the highest operating liquid level to prevent nuisance 
shutdowns but with adequate vessel volume above the LSH 
sensor to prevent overflow before shutdown can be effected. 
The LSL sensor should be located a sufficient distance below 
the lowest operating liquid level to prevent nuisance shut- 
downs but with adequate liquid volume between the LSL sen- 
sor and liquid outlet to prevent gas blowby before shutdown 
can be effected. In fire-tube heated components, the LSL 
should be located above the fire tubes. The LSH and LSL sen- 
sors should preferably be installed in external columns that 
can be isolated from the vessel. This will permit testing the 
devices without interrupting the process. However, if solid 
deposits or foam cause fouling or false indication of devices in 
external columns, the level sensors may be installed directly in 
the vessel. In this case, a pump may be required to manipulate 
vessel liquid level for testing. 

A.4.3.3 Flow Safety Device (FSV) 

Check valves (FSVs) should be located in outlet piping. 



A.4.3.4 Temperature Safety Devices (TSH) 

The TSH sensors, other than fusible or skin contact 
types, should be installed in thermo wells for ease of remov- 
ing and testing. The thermowell should be located where it 
will be accessible and continuously immersed in the heated 
fluid. 

A.5 Atmospheric Vessels 

A.5.1 DESCRIPTION 

Atmospheric vessels are used for processing and tempo- 
rary storage of liquid hydrocarbons. Some applications 
require heat input to the vessel. This discussion covers 
only the effects of heat input to the process section of an 
atmospheric vessel. Heating equipment is covered in A. 6 
and A. 10. Recommended safety devices for typical atmo- 
spheric vessels used in a production process system are 
shown in Figure A-5. Vessels such as those used for diesel 
fuel and chemical storage that are ancillary to the produc- 
tion process system are not covered by this recommended 
practice. However, some of the recommendations con- 
tained in Appendix C.l, ''Emergency Support Systems," 
might be applicable when installing such equipment. 
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1 . TSE designations are symbolic and are not intended to reflect actual location or quantity. 

2. If atmospheric vessel is heated, TSH should be installed. 

3. A vent line might contain pressure and/or vacuum relief device. 

4. A second vent may be installed in lieu of the pressure-vacuum relief device. 



Figure A-5 — Recommended Safety Devices — Atmospheric Vessels 
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A.5.2 SAFETY ANALYSIS 
A.5.2.1 Safety Analysis Table 

The Safety Analysis Table (SAT) for atmospheric ves- 
sels is presented in Table A-5.1. The undesirable events 
that can affect an atmospheric vessel are overpressure, 
underpressure, overflow, leak, and excess temperature if 
the vessel is heated. 

A.5.2.2 Safety Analysis Checklist 

The Safety Analysis Checklist (SAC) for atmospheric ves- 
sels is presented in Table A-5.2. 

A.5.2.2.1 Pressure Safety Devices (Vent and PSV) 

An atmospheric vessel should be protected from overpres- 
sure and underpressure by an adequately-sized vent system. 
API Standard 2000 may be used as a guide for sizing vent 
systems. A flame arrestor should be included in the vent sys- 



tem to prevent flame migration back to the vessel. A pressure- 
vacuum relief device (PSV) or a second vent should be 
installed to protect the vessel in case the primary vent control 
device(s) fouls or otherwise obstructs flow. The PSV or sec- 
ond vent is not required when (a) a pressure vessel not subject 
to collapse is used in atmospheric service, or (b) an atmo- 
spheric vessel has no pressure sources (except blanket gas) 
piped to it. A blanket gas system may be desirable to exclude 
air from an atmospheric vessel. 

A.5.2.2.2 Level Safety Devices (LSH and LSL) 

Protection from liquid overflow from an atmospheric ves- 
sel should be provided by an LSH sensor to shut off inflow 
unless fill operations are continuously attended or overflow is 
diverted to other process components. 

An LSL sensor should be provided to shut off the heat 
source if the vessel has an immersed heating element subject 
to excess temperature. Unless liquid level is not automatically 



Table A-5.1 — Safety Analysis Table (SAT) — Atmospheric Vessels 



Undesirable Event 



Cause 



Detectable Abnormal Condition at 
Component 



Overpressure Blocked or restricted outlet High Pressure 

Inflow exceeds outflow 
Gas blowby (upstream component) 
Pressure control system failure 
Thrcmal expansion 
Excess heat input 

Table A-5.2— Safety Analysis Checklist (SAC) — Atmospheric Vessels 

a. Vent. (Refer to Note) 

l. Vent installed. 

b. Pressure-vacuum Relief Device (PSV). 

1. PSV installed. 

2. Vessel has second vent capable of handling maximum gas volume. 

3. Component is a pressure vessel, not subject to collapse, that operates in atmospheric service and is equipped 
with an adequately sized vent. 

4. Vessel has no pressure sources (except blanket gas and/or manual drains) and is equipped with an adequately 
sized vent. 

c. High Level Sensor (LSH). 

1. LSH installed. 

2. Fill operations arc continuously attended. 

3. Overflow is diverted or contained by other process components. 

d. Low Level Sensor (LSL). 

L LSL installed. 

2. Adequate containment system is provided. 

3. Liquid level is not automatically maintained in the vessel, and vessel docs not have an immersed heating cle- 
ment subject to excess temperature. 

4. Component is final vessel in a containment system designed to collect and direct hydrocarbon liquids to a 
safe location. 

c. High Temperature Sensor (TSH). 

High temperature sensors arc applicable only to vessels having a heat source. 

1. TSH installed. 

2. (Deleted in Second Edition.) 

3. Heat source is incapable of causing excess temperature. 

Note: A vent is a pipe or fitting on a vessel that opens to atmosphere. A vent line might contain a pres- 
sure and/or vacuum relief device. 
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maintained in the vessel an LSL sensor should be provided to 
protect against leaks by shutting of inflow. A containment 
system to collect leakage is preferable to a low level sensor 
when normal inflow of liquids would preclude the sensor's 
detection of aleak. 

A.5.2.2.3 Temperature Safety Devices (TSH) 

If an atmospheric vessel is heated, a TSH sensor should be 
provided to shut off the source of heat when process fluid 
temperature becomes excessive. 

A.5.3 SAFETY DEVICE LOCATION 

The recommended location for safety devices is given in 
A.5.3.1-A.5.3.3. 

A.5.3.1 Pressure Safety Devices (Vent and PSV) 

The vent and PSV should be located on the top (highest 
practical elevation in the vapor section) of atmospheric 
vessels. 

A.5.3.2 Level Safety Devices (LSH and LSL) 

The LSH sensor should be located at a sufficient distance 
above the highest operating liquid level to prevent nuisance 
shutdowns but with adequate vessel volume above the LSH 
sensor to contain liquid inflow during shut in. The LSL 
should be located at a sufficient distance below the lowest 
operating liquid level to avoid nuisance shutdowns. In fire- 
tube heated components, the LSL should be located above the 
fire tubes. The LSH and LSL sensors should preferably be 
located in external columns for ease of testing without inter- 
rupting the process. However, internally mounted sensors are 
also acceptable as discussed in A.4.3.2. 

A.5.3.3 Temperature Safety Devices (TSH) 

The TSH sensors, other than fusible or skin contact types, 
should be installed in thermowells for ease of removal and 
testing. The thermowell should be located for accessibility 
and should be continuously immersed in the process fluid. 

A.6 Fired and Exhaust Heated 
Components 

A.6.1 DESCRIPTION 

Fired and exhaust heated components are used for process- 
ing and heating hydrocarbons. Included are both direct and 
indirect fired atmospheric and pressure vessels and tube-type 
heaters equipped with either automatically controlled natural 
or forced draft burners. Also included are exhaust heated 
components that use exhaust gases from other equipment 
such as turbines and engines as a heat source, and that may or 
may not be supplementary fired. This section discusses the 



required protection for firing equipment of a fired component 
and for the heating section of exhaust heated components. 
Protection for the process portion of a fired or exhaust heated 
component is discussed under the appropriate component. 
Recommended safety devices for a typical fired vessel 
equipped with a natural draft burner or a forced draft burner 
are shown in Figures A-6.1 and A-6.2, respectively. Recom- 
mended safety devices for a typical exhaust heated compo- 
nent are shown in Figure A-6.3. 

A.6.2 SAFETY ANALYSIS 

A.6.2.1 Safety Analysis Table 

The Safety Analysis Table (SAT) is presented for fired 
components with natural draft burners in Table A-6.1, for 
those with forced draft burners in Table A-6.2, and for 
exhaust heated components in Table A-6.3. The undesirable 
events that can affect a fired component or supplementary 
fired exhaust heated component are excess temperature, 
direct ignition source, excess fuel in the firing chambers, and 
overpressure. The undesirable events that can affect an 
exhaust heated component are excess temperature and over- 
pressure. 

A.6.2. 2 Safety Analysis Checklist 

The Safety Analysis Checklist (SAC) for fired and exhaust 
heated components is presented in Table A-6.2. 

A.6.2.2.1 Temperature Safety Devices (TSH) 

a. The medium or process fluid temperature in a fired com- 
ponent should be monitored by a TSH sensor to shut off the 
fuel supply and the inflow of combustible fluids. If a compo- 
nent is exhaust heated, the exhaust should be diverted or the 
source of exhaust shut down. A TSH sensor is not necessary 
on a steam generator protected by a PSH sensor to detect high 
pressure caused by high temperature and by an LSL sensor to 
detect a low level condition that could cause high tempera- 
ture. A TSH to sense medium or process fluid temperature is 
generally not necessary for an indirect water bath heater in 
atmospheric service since the maximum temperature is lim- 
ited by the boiling point of the water bath. 

b. The flow of combustible medium in a closed heat transfer 
system, where the medium is circulated through tubes located 
in the firing or exhaust heated chamber, should not be shut off 
until the chamber has cooled. An ESD system and fire loop 
should immediately shut off medium flow if an uncontrolled 
fire has occurred in the area or the medium is escaping from a 
closed system. 

c. Temperature in the burner exhaust stack should be moni- 
tored by a TSH sensor to shut off the fuel supply and the 
inflow of combustible fluids. Temperature in the exhaust 
heated component stack should be monitored by a TSH sen- 



API Recommended Practice 14C 



33 



sor to shut off the inflow of combustible medium and to shut 
down the exhaust source. A TSH sensor is not required on a 
fired component located in an isolated area not handling com- 
bustibles other than fuel 

A.6.2.2.2 Flow Safety Devices (FSL and FSV) 

When a combustible medium is circulated through tubes 
located in the firing or exhaust heated chamber, the medium 
flow rate should be monitored by an FSL sensor to shut off 
the fuel supply to a fired component or to divert the exhaust 
flow from an exhaust heated component. In this type of com- 
ponent, high temperature in the medium could occur before 
being detected by a TSH (medium) sensor located outside the 
heater. An FSL sensor is not required in other types of heaters 
because the TSH (medium) sensor is located in the medium 
section and should immediately detect the high temperature 
condition. A check valve (FSV) should be located in tube out- 
let piping to prevent backflow into the fired or heated cham- 
ber in the event of tube rupture. 

A.6.2.2.3 Pressure Safety Devices (PSH, PSL, and 
PSV) 

The pressure in the fuel supply line should be monitored by 
a PSH sensor to shut off the fuel supply to the burner. On a 
forced draft burner, a PSL sensor should be installed on the 
fuel supply; also, the air intake pressure of a forced draft 
burner should be monitored by a PSL sensor to shut off the 
fuel and air supply. An air velocity device may be used to 
monitor air supply in lieu of a PSL sensor. The PSL sensor is 
not required on a natural draft burner because of the low air 
intake pressure. Flow tubes located in the firing or exhaust 
heated chamber of a tube type heater should be protected by a 
PSV from overpressure caused by expansion of the medium 
or process fluid. 

A.6.2.2.4 Ignition Safety Devices 

a. The air intake of a natural draft burner should be 
equipped with a flame arrestor to prevent flame migration 
back through the air intake. A flame arrestor is not 
required on a forced draft burner because the air velocity 
through the air intake prevents flame migration, or the PSL 
sensor in the air intake and fan motor starter interlock shut 
off the air intake. 

b. The stack on a natural draft burner should be equipped 
with a stack arrestor to prevent spark emission. When the 
fired component is not handling combustibles other than fuel 
and is located in an isolated area, the arrestor is not necessary. 
A stack arrestor may not be necessary on a forced draft burner 
due to the higher combustion efficiency that prevents carbon 
build-up. A stack arrestor is required if the fluid being heated 
is flammable or the burner draft pressure at the exit of the 
transfer section is lower than the fluid pressure (head). 



c. The motor on a forced draft fan should be equipped with a 
motor starter interlock to sense motor failure and shut oft' the 
fuel and air supply. 

d. The flame in the firing chamber should be monitored by a 
BSL or TSL sensor that will detect a flame insufficient to 
immediately ignite combustibles entering the firing chamber 
and will shut off fuel supply. 

A.6.3 SAFETY DEVICE LOCATION 

The recommended location for safety devices is given in 
A.6.3. l-A.6.3.4. 

A.6.3.1 Temperature Safety Devices (TSH) 

Temperature sensors, other than fusible or skin contact 
types, should be installed in a thermowell for ease of removal 
and testing. When the fire tube is immersed, the TSH sensor 
should be located in the heated liquid medium or process 
fluid. When the liquid medium or process fluid flows through 
tubes within the firing or exhaust heated chambers, the TSH 
sensor should be located in the discharge line as close as is 
practical to the heater and upstream of all isolating devices. A 
TSH sensor in the stack should be located near the base of the 
exhaust stack. 

A.6.3.2 Flow Safety Devices (FSL and FSV) 

In a closed heat transfer system with a combustible 
medium, an FSL sensor should be located in the medium cir- 
culating tube piping. The sensor should be located in the 
medium outlet line as close to the heater as is practical and 
should monitor total flow through the heater. A check valve 
(FSV) should be installed in the tube outlet piping. 

A.6.3.3 Pressure Safety Devices (PSH, PSL, and 
PSV) 

A PSL sensor in the air intake of a forced draft burner 
should be located downstream of the blower. The PSH and 
PSL sensor in the fuel supply line should be located between 
the last pressure regulator and the fuel control valve. A PSV 
on the tubes of a tube type heater should be located where it 
cannot be isolated from the heated section of the tubes. 

A.6.3.4 Ignition Safety Devices 

The flame and stack arrestors on fired components should 
be located to prevent flame emission from the air intake and 
spark emission from the exhaust stack. The BSL sensor 
should be located in the firing chamber. 

A.6.4 SAFE OPERATING PROCEDURES 

In addition to the safety devices indicated in SAC Tables 
A-4.2, A-5.2, and A-6.2, the procedures shown in the Table 
A-6.3 are required to safely operate a fired or exhaust heated 
component. 
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Notes: 

1 . TSE designations arc symbolic and arc not intended to reflect actual location or quantity. 

2. The vessel portion should be analyzed according to Section A.4 or A. 5. 



Figure A-6.1 — Recommended Safety Devices — Typical Fired Vessel (Natural Draft) 
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Notes: 

1 . TSE designations arc symbolic and arc not intended to reflect actual location or quantity. 

2. The vessel portion should be analyzed according to Section A.4 or Section A. 5. 

3. Stack arrestor could be cli minted— refer to Par. A.6.2.b 



Figure A-6.2 — Recommended Safety Devices — Typical Fired Vessel (Forced Draft) 
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Note: 

TSE designations are symbolic and are not intended to reflect actual location or quantity. 

Figure A-6.3 — Recommended Safety Devices — Exhaust Heated Component 
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Table A-6.1 — Safety Analysis Table (SAT) — Fired Components Natural Draft 



Undesirable Event 



Cause 



Detectable Abnormal Condition at 
Component 



Excess temperature 



Temperature control system failure 

Inadequate flow 

Limited heat transfer 

Ignition of medium leak into fired 

Exposed chamber heat transfer surface 



High temperature (process) 
High temperature (stack) 
Low flow rate 
Low liquid level 



Direct ignition source 



Flame emission from air intake 
Spark emission from exhaust stack 
Excess stack temperature 
Exposed hot surface 



Fire 

High temperature stack 



Excess combustible vapors 
in firing chamber 



Fuel control system failure 



Flame failure 
High fuel pressure 



Table A-6.2 — Safety Analysis Table (SAT) — Fired Components Forced Draft 



Undesirable Event 



Cause 



Detectable Abnormal Condition at 
Component 



Excess temperature 



Temperature control system failure 

Inadequate flow 

Limited heat transfer 

Ignition of medium leak into fired 

Exposed chamber heat transfer service 



High temperature (process) 
High temperature (stack) 
Low flow rate 
Low liquid level 



Direct ignition source 



Flame emission from air intake 
Spark emission from exhaust stack 
Excess stack temperature 
Exposed hot surface 



Fire 

High temperature (stack) 



Excess combustible vapors 
in firing chamber 



Fuel control system failure 
Air supply control system failure 
Blocked air inlet 
Blower failure 



Low air pressure 
Flame failure 
High fuel pressure 
Low fuel pressure 
Low air velocity 



Table A-6.3 — Safety Analysis Table (SAT)— Exhaust Heated Components 



Undesirable Event 



Cause 



Detectable Abnormal Condition at 
Component 



Excess temperature 



Temperature control system failure 
Inadequate flow 
Limited heat transfer 
Ignition of medium leak into 
Exposed heated chamber heat transfer 
surface 



High temperature (medium) 
High temperature (stack) 
Low flow rate 
Low liquid level 



Direct ignition source 



Spark emission from exhaust stack 
Excess stack temperature 
Exposed hot surface 



High temperature (stack) 
Fire 



Note: When supplemental firing is used, component should also be analyzed in accordance with 
Table A-6. 1 or Table A-6.2, as applicable. 
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Table A-6.2 — Safety Analysis Checklist (SAC) — Fired and Exhaust Heated Components 

a. High Temperature Sensor (medium or process fluid) (TSH). 

!. TSH installed. 

2. Component is a steam generator protected by a PSH and, if fired, by an LSL. 

3. Component is an indirect water bath heater in atmospheric service and is protected by an LSL. 

b. High Temperature Sensor (stack) (TSH). 

1. TSH installed. 

2. Component is isolated and does not handle combustible medium or process fluids other than fuel. 

3. Component is exhaust heated without supplemental firing and medium is not combustible. 

c. (Deleted in Second Edition.) 

d. Low Pressure Sensor (air Supply) (PSL). 

1. PSL installed. 

2. Component is equipped with a natural draft burner. 

3. Forced draft burner is equipped with another type of low air supply sensor. 

4. Component is exhaust heated without supplemental firing, 
c. High Pressure Sensor (fuel supply) (PSH). 

1. PSH installed. 

2. Component is exhaust heated without supplemental firing. 

f. Low Pressure Sensor (fuel supply) (PSL). 

1. PSL installed. 

2. Component is equipped with a natural draft burner. 

3. Component is exhaust heated without supplemental firing. 

g. Flame Failure Sensor (BSL). 

). BSL installed. 

2. Component is exhaust heated without supplemental firing, 
h. Low flow Sensor (heated medium) (PSL). 

1. FSL installed. 

2. Component is not a closed heat transfer type in which a combustible medium flows through tubes located in 
the firing or exhaust heated chamber. 

i. Motor Interlock (forced draft fan motor). 

1. Motor interlock installed. 

2. Component is equipped with a natural draft burner. 

3. Component is exhaust heated without supplemental firing, 
j. Flame Arrestor (air intake). 

1. Flame arrestor installed. 

2. Component is equipped with a forced draft burner. 

3. Component is located in an isolated area and not handling combustible medium or process fluids other than 
fuck 

4. Component is exhaust heated without supplemental firing. 
k. Stack Arrestor. 

1 . Stack arrestor installed. 

2. Component is equipped with a forced draft burner and (i) the fluid being heated is non-fiammablc, or (ii) the 
burner draft pressure at the exit of the transfer section is higher than the fluid pressure (head). 

3. Component is isolated so process fluids will not contact stack emissions. 

4. Component is exhaust heated without supplemental firing. 
I. Pressure Safety Valve (medium circulating tube) (PSV). 

1. PSV installed. 

2. Component is not a tube type heater. 

3. PSV installed on another component will provide necessary protection and the PSV cannot be isolated from 
the tube section. 

m. Check Valve (medium circulating tube) (FSV). 

1 . FSV installed on each outlet. 

2. The maximum volume of combustible medium that could backfiow from downstream equipment is insignif- 
icant, or medium is not combustible. 

3. Component is not a tube type heater. 
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Table A-6.3 — Safe Operating Procedures 



Assure complete fuel shut off. 

Void firing chamber of excess combustibles prior to pilot ignition. 

Limit time on trial for ignition of pilot and main burner to prevent excess fuel accumulation in fire chamber. After the time limit is 
exceeded, the fuel should be shut off and a manual reset start-up required. 

Prove pilot and assure fuel-air proportioning dampers and burner controls are in low fire position prior to opening fuel supply to 
main burner. 

Manually reset start-up controls following a flame failure of either the pilot or main burner. 

Assure fuel is clean from all residue and foreign materials by providing adequate fuel cleaning equipment. 

Assure that exhaust is diverted around exhaust heated component prior to starting up heat source, if applicable. 
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A.7 Pumps 

A.7.1 DESCRIPTION 

Pumps transfer liquids within the production process and 
into pipelines leaving the platform. Pipeline pumps transfer 
produced hydrocarbons from the process system to a pipeline. 
Pumps that occasionally transfer small volumes of hydrocar- 
bons from ancillary equipment (swab tanks, sumps, etc.) to a 
pipeline that receives the bulk of its volume from another 
source are not considered pipeline pumps. Glycol powered 
glycol pumps circulate glycol within a closed system. Other 
pumps transfer produced liquids, heat transfer liquids, or 
chemicals within the production process system or from the 
containment system to the process system (booster/charge 
pumps, sump pumps chemical injection pumps, heating 
medium circulating pumps, glycol pumps, etc.). Recom- 
mended safety devices for typical pump installations are 
shown in Figures A-7.1, A-7.2, and A-7.3. 

A.7.2 SAFETY ANALYSIS 
A.7.2. 1 Safety Analysis Table 

The Safety Analysis Table (SAT) for pumps is presented in 
SAT Table A-7.1. The undesirable events that can affect a 
pump are overpressure and leak. 

A.7.2.2 Safety Analysis Checklist 

The Safety Analysis Checklist (SAC) for pumps is pre- 
sented in SAC Table A-7.2. 

A.7.2.2.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

PSH and PSL sensors should be provided on all hydrocar- 
bon pipeline pump discharge lines to shut off inflow and shut 
down the pump, A PSH sensor to shut down the pump should 
be provided on the discharge line of other pumps, unless the 
maximum pump discharge pressure does not exceed 70% of 
the maximum allowable working pressure of the discharge 
line or the pump is manually operated and continuously 
attended. A PSH sensor is not required on glycol powered 
glycol pumps. Other hydrocarbon pumps should also be pro- 
vided with a PSL sensor to shut down the pump, unless the 
pump is manually operated and continuously attended or ade- 
quate containment is provided. PSL sensors should be pro- 
vided on glycol powered glycol pumps to shut off wet glycol 
flow to the pump. 



A PSV should be provided on all pipeline pump discharge 
lines, unless the pump is a kinetic energy type, such as a cen- 
trifugal pump, and is incapable of generating a head greater 
than the maximum allowable working pressure of the dis- 
charge piping. A PSV should be provided in the discharge 
line of all other pumps unless the maximum pump discharge 
pressure is less than the maximum allowable working pres- 
sure of the line, or the pump has an internal pressure relief 
capability. A PSV should be provided in the wet glycol low 
pressure discharge line of glycol powered glycol pumps 
unless the line is rated higher than the maximum pump dis- 
charge pressure or is protected by a PSV on a downstream 
component that cannot be isolated from the pump. 

A.7.2.2.2 Flow Safety Devices (FSV) 

A check valve (FSV) should be provided in the pump dis- 
charge line to minimize backflow. 

A.7.3 SAFETY DEVICE LOCATION 

The recommended location for safety devices is given 
below: 

A.7.3.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

The PSH and PSL sensors should be located on the pump 
discharge line upstream of the FSV or any block valve. In a 
glycol powered glycol pump, the PSL on the wet glycol high 
pressure line should be located between the pump and the 
SDV On pipeline pumps and other pumps where it is 
required, the PSV should be located on the discharge line 
upstream of any block valve. 

A.7.3.2 Flow Safety Devices (FSV) 

The check valve (FSV) should be located on the pump dis- 
charge line to minimize backflow. 

A.7.3.3 Shutdown Devices (SDV) 

An SDV should be located near the outlet of a storage 
component (tank, separator, etc.) that delivers production to a 
pipeline pump to prevent the flow of hydrocarbons through 
the pipeline pump and into the pipeline in the event of a pipe- 
line leak. When glycol powered pumps are used, a SDV 
should be located near the high pressure wet glycol outlet of 
the glycol contactor to shut off flow from the contactor and to 
shut down the pumps. 
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Note: 

TSE designations are symbolic and are not intended to reflect actual location or quantity. 

Figure A-7.1 — Recommended Safety Devices — Pipeline Pump 
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Figure A-7.2 — Recommended Safety Devices — Glycol Powered Glycol Pump 
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Figure A-7.3 — Recommended Safety Devices — Other Pump 
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Table A-7.1 — Safety Analysis Table (SAT) — Pumps 



Detectable Abnormal Condition at 
Undesirable Event Cause Component 

Overpressure Blocked or restricted discharge line High pressure 

Excess back pressure 
High inlet pressure (centrifugal) 
Ovcrspced 
Fluid density increase 

Leak Deterioration Low pressure 

Erosion 
Corrosion 
Impact damage 
Vibration 

Table A-7.2— Safety Analysis Checklist (SAC)— Pumps 

a. High Pressure Sensor (PSH)— pipeline pumps. 

i. PSH installed. 

b. High Pressure Sensor (PSH)— other pumps. 

1. PSH installed. 

2. Maximum pump discharge pressure docs not exceed 70 percent of the maximum allowable working 
pressure of the discharge piping. 

3. Pump is manually operated and continuously attended. 

4. Small, low volume pumps, e.g. chemical injection. 

5. Pump discharges to an atmospheric vessel. 

6. Pump is a glycol powered glycol pump. 

c. Low Pressure Sensor (PSL)— pipeline pumps. 

1. PSL installed. 

2. Pump docs not handle hydrocarbons. 

d. Low Pressure Sensor (PSL)— other pumps. 

L PSL installed. 

2. Pump is manually operated and continuously attended. 

3. Adequate containment is provided. 

4. Small, low volume pumps, e.g. chemical injection pumps. 

5. Pump discharges to an atmospheric vessel, 
c. Pressure Safety Valves (PSV) — pipeline pumps. 

1. PSV installed. 

2. Pump is kinetic energy type and incapable of generating a head greater than the maximum allowable 
working pressure of the discharge piping. 

f. Pressure Safety Valves (PSV)— other pumps. 

1. PSV installed. 

2. Maximum pump discharge pressure is less than the maximum allowable working pressure of discharge 
piping. 

3. Pump has internal pressure relief capability. 

4. Pump is a glycol powered glycol pump, and the wet glycol low pressure discharge piping is rated higher than 
the maximum discharge pressure. 

5. Pump is a glycol powered glycol pump, and the wet glycol low pressure discharge piping is protected by a 
PSV on a downstream component that cannot be isolated from the pump. 

g. Check Valve (FSV)— all pumps. 

I. Check valve installed. 
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A.8 Compressor Units 

A.8.1 DESCRIPTION 

Compressor units transfer hydrocarbon gases within the 
production process and into pipelines leaving the platform. 
Recommended safety devices for a typical compressor unit 
are shown in Figure A- 8. 

A.8.2 SAFETY ANALYSIS 
A.8.2.1 Safety Analysis Table 

The Safety Analysis Table (SAT) for compressor units is 
presented in SAT Table A-8.1. The SAT analyzes the com- 
pressor cylinder or case and the suction, discharge, and fuel 
gas piping of a compressor unit. Hydrocarbon handling 
equipment associated with compressors, other than compres- 
sor cylinders or cases, should be protected in accordance with 
appropriate sections of this recommended practice. The com- 
pressor and prime mover are normally furnished with devices 
to prevent mechanical damage. The undesirable events that 
can affect a compressor unit are overpressure, leak, and 
excess temperature. 

A.8.2. 2 Safety Analysis Ckecklist 

The Safety Analysis Checklist (SAC) for compressor units 
is presented in SAC Table A-8.2. 

A.8.2.2.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

PSH and PSL sensors should be provided on each suction 
line of a compressor unit unless each input source is protected 
by PSH and PSL sensors that will also protect the compres- 
sor. Also, PSH and PSL sensors should be provided on each 
compressor discharge line. The PSH and PSL sensors should 
shut off all process inflow and fuel gas to the compressor. A 
PSV should be provided on each compressor suction line, 
unless each input source is protected by a PSV that will pro- 
tect the compressor. A PSV should be provided on each com- 
pressor discharge line. A PSV is not necessary on the 
discharge of a kinetic energy compressor if the compressor is 
incapable of developing a pressure greater than the maximum 
allowable working pressure of the compressor or discharge 
piping. 

A.8.2.2.2 Flow Safety Devices (FSV) 

A check valve (FSV) should be provided in each final dis- 
charge line to minimize backflow. 

A.8.2.2.3 Gas Detecting Devices (ASH) 

If a compressor unit is installed in an inadequately venti- 
lated building or enclosure, as defined in C.1.4, gas detectors 



(ASHs) should be provided to shut off all process inflow and 
fuel gas to the compressor and blowdown the compressor. 

A.8.2.3 Temperature Safety Devices (TSH) 

A TSH sensor should be provided to protect each compres- 
sor cylinder or case. The TSH sensor should shut off all pro- 
cess inflow and fuel gas to the compressor. 

A.8.3 SAFETY DEVICE LOCATION 

The recommended location for safety devices is given in 
A.8.3. l-A.8.3.5. 

A.8.3.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

The PSH and PSL sensors should be located on each suc- 
tion line as close to the compressor as is practical, and on 
each discharge line upstream of the FSV and any block valve. 
The PSVs should be located on each suction line as close to 
the compressor as is practical, and on each discharge line so 
that the PSV cannot be isolated from the compressor. If a 
PSV is located inside a building, its discharge outlet should 
be piped to a safe location outside the building. 

A.8.3.2 Flow Safety Devices (FSV) 

A check valve (FSV) should be located on each compres- 
sor unit's final discharge line to minimize backflow. If the 
compressor unit is inside a building, the FSV should be 
located outside the building. 

A.8.3.3 Gas Detecting Devices (ASH) 

Should the compressor unit be installed in an inadequately 
ventilated building or enclosure, gas detectors (ASHs) should 
be located in areas where combustible gases can accumulate. 

A.8.3.4 Temperature Safety Devices (TSH) 

A TSH sensor should be located in the discharge piping of 
each compressor cylinder or case is as close as practical to the 
cylinder or case. 

A.8.3.5 Shutdown Devices (SDV) 

A SDV should be located on each process inflow line and 
fuel gas line so that the compressor can be isolated from all 
input sources. If the compressor unit is installed in a building, 
SDVs should be located outside the building. All SDVs 
should be actuated by a signal from the ESD system and fire 
loop, and by any abnormal pressure condition sensed in the 
suction and discharge lines. A blowdown valve should be 
located on the compressor unit final discharge line(s). The 
blowdown valve(s) may be actuated by a signal from the 
compressor's fire loop, gas detectors, and compressor ESD 
system. 
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Notes: 

1 . TSE designations arc symbolic and arc not intended to reflect actual location or quantity. 

2. ASH 1 , 2 & OSH 1 , 2 arc not required if compressor is not installed in an enclosed building. 

3. ASH 3 is not required if compressor docs not have piping or other potential source of gas leak below a solid subfloor. 

4. Suction scrubbers arc not shown; they should be analyzed according to Section A.4. 

5. OSH should be considered based on the conditions stated in Appendix F, Pars. F-l . I and F-l .2. 

6. Shell-tube type discharge coolers arc not shown; they should be analyzed according to section A. 10. 



Figure A-8 — Recommended Safety Devices — Compressor Unit 
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Table A-8.1 — Safety Analysis Table (SAT) — Compressors 



Undesirable Event 



Cause 



Detectable Abnormal Condition at 
Component 



Overpressure (suction) 



Overpressure (discharge) 



Excess inflow High pressure 

Failure of suction pressure control system 
Compressor or driver malfunction 

Blocked or restricted discharge line High pressure 

Excess back pressure 
High inlet pressure 
Ovcrspccd 



Leak 



Deterioration 
Erosion 
Corrosion 
Impact damage 
Vibration 



Low pressure 

High gas concentration (building) 



Excess temperature 



Compressor valve failure 
Cooler failure 
Excess compression ratio 
Insufficient flow 



High temperature 



Table A-8. 2— Safety Analysis Checklist (SAC) — Compressors 

a. High Pressure Sensor (PSH) — suction. 

1. PSH installed. 

2. Each input source is protected by a PSH that will also protect the compressor. 

b. High Pressure Sensor (PSH)— discharge. 

1. PSH installed. 

2. Compressor is protected by a downstream PSH, located upstream of any cooler, that cannot be isolated from 
the compressor. 

c. Low Pressure Sensor (PS L)— suction. 

i. PSL installed. 

2. Each input source is protected by a PSL that will also protect the compressor. 

d. Low Pressure Sensor (PSL) — discharge. 

1. PSL installed. 

2. Compressor is protected by a downstream PSL that cannot be isolated from the compressor. 

e. Pressure Safety Valve (PSV)— suction. 

1. PSV installed. 

2. Each input source is protected by a PSV that will also protect the compressor. 

f. Pressure Safety Valve (PSV)— discharge. 

1. PSV installed. 

2. Compressor is protected by a downstream PSV, located upstream of any cooler, that cannot be isolated from 
the compressor. 

3. Compressor is kinetic energy type and incapable of generating a pressure greater than the maximum allow- 
able working pressure of the compressor or discharge piping. 

g. Check Valve (PSV)— final discharge. 

I. PSV installed, 
h. High Temperature Sensor (TSH). 
I. TSH installed. 
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A.9 Pipelines 

A.9.1 DESCRIPTION 

Offshore pipelines direct liquids and gases between plat- 
forms or between a platform and a shore facility. Pipelines are 
classified as (a) incoming, (b) departing, or (c) bidirectional, 
depending on the direction of flow at the platform. An incom- 
ing pipeline directs fluids onto the platform and a departing 
pipeline transports fluids from the platform. A bidirectional 
pipeline can transport fluids in either direction. Pipelines can 
be further classified according to the delivery or receiving 
point as follows: 

a. Incoming pipelines: 

1 . Deliver to platform facilities. 

2. Deliver to departing pipeline. 

b. Departing pipelines: 

1. Receive from platform facilities. 

2. Receive from incoming pipeline(s). 

3. Receive from both platform facilities and incoming 
pipeline(s). 

c. Bidirectional pipelines: 

1. Deliver to and receive from platform facilities. 

2. Deliver to and receive from another bidirectional 
pipeline. 

3. Deliver to and receive from other bidirectional pipe- 
lines and receives from platform facilities. 

A.9.2 SAFETY ANALYSIS 
A.9.2.1 Safety Analysis Table 

The Safety Analysis Table (SAT) for pipelines is presented 
in SAT Table A-9.1 . The undesirable events that can affect a 
pipeline are overpressure and leak. 

A.9.2.2 Safety Analysis Checklist 

The Safety Analysis Checklist (SAC) for pipelines is pre- 
sented in SAC Table A-9.2. 

A.9.2.2.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

PSH and PSL sensors are required on departing pipelines 
to shut off all input sources. PSH and PSL sensors are not 
provided on an incoming pipeline that is protected by sensors 
provided at the upstream platform. Bidirectional pipelines 
should be provided with PSH and PSL sensors. Protection 
may be provided by PSH and PSL sensors located at each 
input source or on a parallel component (looped pipeline) if 
the sensors cannot be isolated from the pipeline. 

Each pipeline input source is normally protected by a PSV 
set also to protect the pipeline. A PSV is not required if (a) the 
pipeline has a maximum allowable operating pressure greater 
than the maximum pressure of any input source; (b) each 
input source having a pressure greater than the pipeline's 



maximum allowable operating pressure is protected by a PSV 
set no higher than the pipeline's maximum allowable operat- 
ing pressure; or (c) input source is a well(s) having a pressure 
greater than the pipeline's maximum allowable operating 
pressure and is equipped with two SDVs (one of which may 
be the SSV) controlled by independent PSHs connected to 
separate relays and sensing points. The use of two SDVs in 
lieu of a PSV should be approached with caution after thor- 
ough consideration of other alternatives. In some cases, 
installation of a PSV in addition to two SDVs might be desir- 
able even at locations having no containment system. 

A.9.2.2.2 Flow Safety Devices (FSV) 

A FSV is provided on an incoming pipeline to minimize 
backflow to a leak or rupture in the pipeline, and on a depart- 
ing pipeline to minimize backflow to a leak or rupture in a 
component on the platform. When an incoming pipeline con- 
nects only to a departing pipeline, the FSV on the departing 
pipeline also protects the incoming pipeline. A FSV may be 
eliminated on a departing pipeline if all input sources are 
equipped with FSVs located so that no significant length of 
piping is unprotected from backflow from the pipeline. A 
FSV cannot be installed on a bidirectional pipeline. 

A.9.3 SAFETY DEVICE LOCATION 

The recommended location for safety devices is given in 
A.9.3.1-A.9.3.3. 

A.9.3.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

The PSH and PSL sensors should be located downstream of 
any platform input source and upstream of a departing pipe- 
line FSV If a PSV is required, it should be located down- 
stream of all input sources and installed so that it cannot be 
isolated from inlet sources. 

A.9.3.2 Flow Safety Devices (FSV) 

Incoming pipelines delivering to a platform process sta- 
tion should have a FSV located immediately upstream from 
the process station. The FSV on a departing pipeline should 
be located as far downstream as is practical, but upstream of 
a block valve. 

A.9.3.3 Shutdown Devices (SDV) 

Pipeline SDVs should be located to minimize the portion 
of pipeline exposed on the platform. All SDVs should be 
actuated by the platform ESD system, fire loop, and sensors 
on any downstream component through which the pipeline 
fluids flow. The SDV on a pipeline delivering to a departing 
pipeline should be actuated by the departing pipeline's PSH 
and PSL sensors, the ESD system, and the fire loop. Bidirec- 
tional pipelines should be equipped with SDVs on each plat- 
form terminus. 
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Figure A-9 — Recommended Safety Devices— Pipelines 
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Table A-9.1— Safety Analysis Table (SAT)— Pipelines 

Detectable Abnormal Condition at 
Undesirable Event Cause Component 

Overpressure Blocked or restricted lire High pressure 

Thermal expansion 
Inflow exceeds outflow 

Leak Deterioration Low pressure 

Erosion 
Corrosion 
Impact damage 
Vibration 



Table A-9.2— Safety Analysis Checklist (SAC)— Pipelines 

High Pressure Sensor (PSH). 

1. PSH installed. 

2. Delivering pipeline protected by PSH located on upstream component. 

3. Bach input source is protected by a PSH that also protects a departing or bidirectional pipeline. 

4. The pipeline is protected by a PSH located on a parallel component. 
Low Pressure Sensor (PSL). 

1. PSL installed. 

2. Delivering pipeline protected by PSL located on upstream component. 

3. Each input source is protected by a PSL that also protects a departing or bidirectional pipeline. 

4. The pipeline is protected by a PSL located on a parallel component. 
Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Pipeline has a maximum allowable operating pressure greater than the maximum pressure of any input 
source. 

3. Bach input source having a pressure greater than the maximum allowable operating pressure of the pipeline 
is protected by a PSV set no higher than the maximum allowable operating pressure of the pipeline. 

4. The pipeline does not receive input from the platform process. 

5. Input source is a wcll(s) having a pressure greater than the maximum allowable operating pressure of the 
pipeline and is equipped with two SDVs (one of which may be the SSV) controlled by independent PSHs con- 
nected to separate relays and sensing points. Other input sources having a pressure greater than the maximum 
allowable operating pressure of the pipeline arc protected by PS Vs. 

Check Valve (FSV). 

1. PSV installed. 

2. Departing pipeline is equipped with an SDV controlled by a PSL. 

3. Bach input source is protected by an FSV located so that no significant length of pipeline is unprotected 
from backflow. 

4. Pipeline is used for bidirectional flow. 
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A.10 Heat Exchangers (Shell-Tube) 

A.10.1 DESCRIPTION 

Heat exchangers transfer thermal energy from one flow 
stream to another while maintaining isolation of the two flow 
streams. Recommended safety devices for a typical shell-tube 
heat exchanger are shown in Figure A- 10. 1 . This section does 
not apply to exchangers used with primary heat sources such 
as turbine exhaust exchangers that should be analyzed under 
A. 6, "Fired Components." This section may be used to ana- 
lyze heating or cooling coils inserted into vessels, but the ves- 
sels themselves should be analyzed under A.4 or A.5, as 
appropriate. This section may also be used to analyze heat 
exchangers using air to cool or heat hydrocarbons, in which 
case only the hydrocarbon section need be considered. 

A.10.2 SAFETY ANALYSIS 
A.1 0.2.1 Safety Analysis Table 

The Safety Analysis Table (SAT) for heat exchangers is 
presented in SAT Table A- 10.1. The undesirable events that 
can affect a heat exchanger are overpressure and leak. 

A.1 0.2.2 Safety Analysis Checklist 

The Safety Analysis Checklist (SAC) for exchangers is 
presented in SAC Table A- 10.2. 

A.1 0.2.2.1 Pressure Safety Devices (PSH, PSL, 
and PSV) 

a. In analyzing heat exchangers for pressure safety devices, 
both sections (the heat receiving section and the heat input 
section) should be analyzed separately since each section 
may have different design and operating pressure require- 
ments. A section of a heat exchanger that receives fluids from 
a source that can cause overpressure should be protected by a 
PSH sensor to shut off inflow of the source to that section of 
the heat exchanger. Also, a section of the heat exchanger that 
could be overpressured because of a rupture or leak of 
another section of the heat exchanger should be protected by 
a PSH sensor to shut off inflow of the source of overpressure 
to that section. The PSH sensor need not be provided for a 
section of a heat exchanger if an upstream PSH sensor on 
other process components will sense the pressure in the heat 
exchanger section and shut off inflow to the heat exchanger, 
or if a downstream PSH sensor will sense pressure in the heat 
exchanger section and cannot be isolated. Also, the PSH sen- 
sor need not be provided on a section of a heat exchanger if 
the maximum allowable working pressure of that section is 



greater than the potential pressure of any input source to that 
section. 

b. A heat exchanger section containing hydrocarbons should 
be provided with a PSL sensor to shut off inflow to the heat 
exchanger when leaks large enough to reduce pressure occur, 
unless PSL sensors on other components will provide neces- 
sary protection and the PSL sensor cannot be isolated from 
the heat exchanger section when in service. A PSL sensor 
should not be installed if the heat exchanger section normally 
operates at atmospheric pressure or frequently varies to atmo- 
spheric while in service. In this case, the complexity of lock- 
out devices to keep the heat exchanger from shutting in 
during these operating modes could more than offset the pro- 
tection afforded by the PSL sensor. 

c. A heat exchanger section should be provided with a PSV 
with sufficient capacity to discharge maximum input rates. A 
PSV need not be provided on a heat exchanger section if 
PSVs on other process components provide adequate relief 
capacity, relieve at or below heat exchanger section working 
pressure, and cannot be isolated from the section when in ser- 
vice. If such PSVs are located on downstream components, 
they must not be isolated from the heat exchanger section at 
any time. Also, the PSV need not be provided on a section of 
a heat exchanger if the maximum allowable working pressure 
of that section is greater than the potential pressure of any 
input source to that section. Moreover, if PSVs on other com- 
ponents provide necessary protection when the heat 
exchanger section is in service, but can be isolated when the 
heat exchanger section is shut in, a PSV should be installed 
on the heat exchanger section for pressure relief due to ther- 
mal expansion or fire exposure. 

A.1 0.2.2.2 Temperature Safety Devices (TSH) 

A TSH is not generally required in a shell-tube exchanger 
because both sections are normally rated for the maximum 
temperature of the heat medium. 

A.1 0.3 SAFETY DEVICE LOCATION —PRESSURE 
SAFETY DEVICES (PSH, PSL, AND PSV) 

A.1 0.3.1 Pressure Safety Devices (PSH, PSL, and 
PSV) 

The PSH and PSL sensors and the PSV should be located 
to sense pressure in or relieve it from each section of the heat 
exchanger. Such devices may be located in the inlet or outlet 
piping if the pressure drop from the heat exchanger section to 
the sensing point is negligible and if the devices cannot be 
isolated from the heat exchanger section. 
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Table A-1 0.1— Safety Analysis Table (SAT)— Heat Exchangers (Shell-Tube) 

Detectable Abnormal Condition at 
Undesirable Event Cause Component 

Overpressure Blockage or restriction High pressure 

Inflow exceeds outflow 
Thermal expansion 
Tube leak 
Vaporization 

Leak Deterioration Low pressure 

Erosion 
Corrosion 
Impact damage 
Vibration 



Table A-1 0.2— Safety Analysis Checklist (SAC)— Heat Exchangers (Shell-Tube) 

. High Pressure Sensor (PSH). 

1. PSH installed. 

2. Input source to heat exchanger section cannot develop pressure greater than the maximum allowable work- 
ing pressure of the heat exchanger section. 

3. Each input source is protected by a PSH that also protects the heat exchanger section. 

4. A PSH is installed on a downstream component and cannot be isolated from the heat exchanger section by 
block or regulating valves. 

. Low Pressure Sensor (PSL). 

1. PSL installed. 

2. Minimum operating pressure is atmospheric pressure when in service. 

3. PSL installed on another component will provide necessary protection and the PSL cannot be isolated from 
the heat exchanger section when the heat exchanger is in service. 

. Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Each input source is protected by a PSV that is set no higher than the maximum allowable working pressure 
of the heat exchanger section and a PSV is installed on the heat exchanger section for fire exposure and thermal 
relief. 

3. Each input source is protected by a PSV that is set no higher than the maximum allowable working pressure 
of the heat exchanger section and that cannot be isolated from the heat exchanger section. 

4. PSVs on downstream equipment can satisfy relief requirement of the heat exchanger section and cannot be 
isolated from the heat exchanger section. 

5. Deleted in Fourth Edition. 

6. Input sources to the heat exchanger section cannot develop pressure greater than the maximum allowable 
working pressure of the heat exchanger section and the heat exchanger section cannot be ovcrprcsstircd due to 
temperature or pressure in the other section. 

7. Each input source is protected by a PSV set no higher than the maximum allowable working pressure of the 
heat exchanger section and the heat exchanger section cannot be overprcssurcd due to temperature or pressure 
in the other section. 
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Table B-1— Composite Safety Analysis Checklist (SAC) 
A.1 Flow Line Segment 

a. High Pressure Sensor (PSH). 

1. PSH installed. 

2. Flow line segment has a maximum allowable working pressure greater than maximum shut in pressure and 
is protected by a PSH on a downstream flow line segment. 

b. Low Pressure Sensor (PSL). 

1. PSL installed. 

2. Flow line segment is between the well and the first choking device and is less than 1 feet (3m) in length or, 
in the case of an underwater installation, reasonably close to that distance 

c. Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Flow line segment has maximum allowable working pressure greater than the maximum shut in pressure. 

3. Two SDVs (one of which may be the SSV) with independent PSHs, relays, and sensing points arc installed 
where there is adequate flow line volume upstream of any block valves to allow sufficient time for the SDVs to 
close before exceeding the maximum allowable working pressure. 

4. Flow line segment is protected by a PSV on upstream segment. 

5. Flow line segment is protected by a PSV on downstream component that cannot be isolated from the flow 
line segment and there arc no chokes or other restrictions between the flow line segment and the PSV. 

d. Flow Safety Valve (FSV). 

1. FSV installed. 

2. Flow line segment is protected by FSV in final flow line segment. 

A.2 Wellhead Injection Lines 

a. High Pressure Sensor (PSH). 

L PSH installed. 

2. Line and equipment arc protected by an upstream PSH. 

b. Low Pressure Sensor (PSL). 

1. PSL installed. 

2. Line and equipment are protected by an upstream PSL. 

c. Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Line and equipment have a maximum allowable working pressure greater than the maximum pressure that 
can be imposed by the injection source. 

3. Line and equipment arc protected by an upstream PSV. 

d. Check Valve (FSV). 

I. FSV(s) installed. 

A.3 Headers 

a. High Pressure Sensor (PSH). 

1. PSH installed. 

2. Bach input source is equipped with a PSH set less than the maximum allowable working pressure of the 
header. 

3. Header is protected by downstream PSH that cannot be isolated from the header. 

4. Header is for Hare, relief, vent, or other atmospheric service and has no valving in the outlet piping. 

b. Low Pressure Sensor (PSL). 

1. PSL installed. 

2. Each input source is protected by a PSL and there arc no pressure control devices or restrictions between the 
PSL and the header. 

3. Header is for flare, relief, vent, or other atmospheric service. 

c. Pressure Safety Valve (PSV). 

!. PSV installed. 

2. Header has a maximum allowable working pressure greater than the maximum shut in pressure of any con- 
nected well. 

3. Pressure relief protection is provided on each input source having a maximum shut in pressure greater than 
the maximum allowable working pressure of the header. 

4. Header is protected by downstream PSV that cannot be isolated from the header. 

5. Header is for flare, relief, vent, or other atmospheric service and has no valving in the outlet piping. 

6. Input source is a wcll(s) having a pressure greater than the maximum allowable working pressure of the 
header and is equipped with two SDVs (one of which may be the SSV) controlled by independent PSHs con- 
nected to separate relays and sensing points. Other input sources having a pressure greater than the maximum 
allowable working pressure of the header arc protected by PS Vs. 
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Table B-1 — Composite Safety Analysis Checklist (SAC) (Continued) 
A.4 Pressure Vessels 

a. High Pressure Sensor (PSH). 

1. PSH installed. 

2. Input is from a pump or compressor that cannot develop pressure greater than the maximum allowable work- 
ing pressure of the vessel. 

3. Input source is not a wellhead flow linc(s), production header, or pipeline and each input source is protected 
by a PSH that protects the vessel. 

4. Adequately sized piping without block or regulating valves connects gas outlet to downstream equipment 
protected by a PSH that also protects the upstream vessel. 

5. Vessel is final scrubber in a flare, relief, or vent system and is designed to withstand maximum built up back 
pressure. 

6. Vessel operates at atmospheric pressure and has an adequate vent system. 

b. Low Pressure Sensor (PSL). 

1. PSL installed. 

2. Minimum operating pressure is atmospheric pressure when in service. 

3. Each input source is protected by a PSL and there are no pressure control devices or restrictions between the 
PSL(s) and the vessel. 

4. Vessel is scrubber or small trap, is not a process component, and adequate protection is provided by down- 
stream PSL or design function (e.g., vessel is gas scrubber for pneumatic safety systems or final scrubber for 
flare, relief, or vent system). 

5. Adequately sized piping, without block or regulating valves connects to gas outlet to downstream equipment 
protected by a PSL that also protects the upstream vessel. 

c. Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Each input source is protected by a PSV set no higher than the maximum allowable working pressure of the 
vessel and a PSV is installed on the vessel for fire exposure and thermal expansion. 

3. Each input source is protected by a PSV set no higher than the vessel's, at least one of these PSVs cannot be 
isolated from the vessel. 

4. PSVs on downstream equipment can satisfy relief requirement of the vessel and cannot be isolated from the 
vessel. 

5. Vessel is final scrubber in a flare, relief, or vent system, is designed to withstand maximum built up back 
pressure, and has no internal or external obstructions, such as mist extractors or back pressure valves. 

6. Vessel is final scrubber in a flare, relief, or vent system, is designed to withstand maximum built up back 
pressure, and is equipped with a rupture disk or safety head (PSE) to bypass any internal or external obstruc- 
tions, such as mist extractor or back pressure valves. 

d. High Level Sensor (LSH). 

1. LSH installed. 

2. Equipment downstream of gas outlet is not a flare or vent system and can safely handle maximum liquid 
carry-over. 

3. Vessel function docs not require handling separated fluid phases. 

4. Vessel is small trap from which liquids arc manually drained. 

e. Low Level Sensor (LSL). 

1 . LSL installed to protect each liquid outlet. 

2. Liquid level is not automatically maintained in the vessel and the vessel does not have an immersed heating 
element subject to excess temperature. 

3. Equipment downstream of liquid outlct(s) can safely handle maximum gas rates that can be discharged 
through the liquid outlct(s) and vessel docs not have an immersed heating clement subject to excess tempera- 
ture. Restrictions in the discharge linc(s) may be used to limit the gas flow rate. 

f. Check Valve (FSV). 

1. FSV installed on each outlet 

2. The maximum volume of hydrocarbons that could backflow from downstream equipment is insignificant. 

3. A control device in the line will effectively minimize backflow. 

g. High Temperature Sensor (TSH). 

High temperature sensors arc applicable only to vessels having a heat source. 

1. TSH installed. 

2. (Deleted in Second Edition.) 

3. Heat source is incapable of causing excess temperature. 
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Table B-1— Composite Safety Analysis Checklist (SAC) (Continued) 
A.5 Atmospheric Vessels 

a. Vent. 

I . Vent installed. 

b. Pressure- Vacuum Relief Device (PSV). 

1. PSV installed. 

2. Vessel has second vent capable of handling maximum gas volume. 

3. Component is a pressure vessel, not subject to collapse, that operates in atmospheric service and is equipped 
with an adequately sized vent. 

4. Vessel has no pressure sources (except blanket gas and/or manual drains) and is equipped with an adequately 
sized vent. 

c. High Level Sensor (LSH). 

1. LSH installed. 

2. Pill operations arc continuously attended. 

3. Overflow is diverted or contained by other process components. 

d. Low Level Sensor (LSL). 

1. LSL installed. 

2. Adequate containment system is provided. 

3. Liquid level is not automatically maintained in the vessel and vessel docs not have an immersed heating cle- 
ment subject to excess temperature. 

4. Component is final vessel in a containment system designed to collect and direct hydrocarbon liquids to a 
safe location. 

c. High Temperature Sensor (TSH). 

High temperature sensors arc applicable only to vessels having a heat source. 

1. TSH installed. 

2. (Deleted in Second Edition.) 

3. Heat source is incapable of causing excess temperature. 

A.6 Fired and Exhaust Heated Components 

a. High Temperature Sensor (medium or process fluid) (TSH). 

1. TSH installed. 

2. Component is a steam generator protected by a PSH and, if fired, by a LSL. 

3. Component is an indirect water bath heater in atmospheric service and is protected by an LSL. 

b. High Temperature Sensor (stack) (TSH). 

1. TSH installed. 

2. Component is isolated and docs not handle combustible medium or process fluids other than fuel. 

3. Component is exhaust heated without supplemental firing and medium is not combustible. 

c. (Deleted in Second Edition.) 

d. Low Pressure Sensor (air supply) (PSL). 

1. PSL installed. 

2. Component is equipped with a natural draft burner. 

3 . Forced draft burner is equipped with another type of low air supply sensor. 

4. Component is exhaust heated without supplemental firing, 
c. High Pressure Sensor (fuel supply) (PSH). 

1. PSH installed. 

2. Component is exhaust heated without supplemental firing. 

f. Low Pressure Sensor (fuel supply) (PSL). 

1. PSL installed. 

2. Component is equipped with a natural draft burner. 

3. Component is exhaust heated without supplemental firing. 

g. Flame Failure Sensor (BSL). 

1. BSL installed. 

2. Component is exhaust heated without supplemental firing, 
h. Low flow Sensor (heated medium) (FSL). 

i. FSL installed. 

2. Component is not a closed heat transfer type in which a combustible medium flows through tubes located in 
the firing or exhaust heated chamber, 
i. Motor Interlock (forced draft fan motor). 

1 . Motor interlock installed. 

2. Component is equipped with a natural draft burner. 

3. Component is exhaust heated without supplemental firing. 
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Table B-1 — Composite Safety Analysis Checklist (SAC) (Continued) 

j. Flame Arrcstor (air intake). 

1. Flame arrestor installed. 

2. Component is equipped with a forced draft burner. 

3. Component is located in an isolated area and not handling combustible medium or process fluids other than 
fuel. 

4. Component is exhaust heated without supplemental firing, 
k. Stack Arrcstor. 

1. Stack arrestor installed. 

2. Component is equipped with a forced draft burner and (i) the fluid being heated is non-flammable, or (ii) the 
burner draft pressure at the exit of the transfer section is higher than the fluid pressure (head). 

3. Component is isolated so process fluids will not contact stack emissions. 

4. Component is exhaust heated without supplemental firing. 
I. Pressure Safety Valve (medium circulating tube) (PSV). 

1. PSV installed. 

2. Component is not a tube type heater. 

3. PSV installed on another component will provide necessary protection and the PSV cannot be isolated from 
the tube section. 

m. Check Valve (medium circulating tube) (FSV). 

1 . FSV installed on each outlet. 

2. The maximum volume of combustible media that could backflow from downstream equipment is insignifi- 
cant, or medium is not combustible. 

3. Component is not a tube type heater. 

A.7 Pumps 

a. High Pressure Sensor (PSH) pipeline pumps. 

1. PSH installed. 

b. High Pressure Sensor (PSH)— other pumps. 

1. PSH installed. 

2. Maximum pump discharge pressure docs not exceed 70 percent of the maximum allowable working 
pressure of discharge piping. 

3. Pump is manually operated and continuously attended. 

4. Small, low volume pumps, e.g., chemical injection pumps. 

5. Pump discharges to an atmospheric vessel. 

6. Pump is a glycol powered glycol pump. 

c. Low Pressure Sensor (PS L)— pipeline pumps. 

1. PSL installed. 

2. Pump docs not handle hydrocarbons. 

d. Low Pressure Sensor (PSL)— other pumps. 

1. PSL installed. 

2. Pump is manually operated and continuously attended. 

3. Adequate containment is provided. 

4. Small, low volume pumps, e.g., chemical injection pumps. 

5. Pump discharges to an atmospheric vessel, 
c. Pressure Safety Valves (PSV)— pipeline pumps. 

1. PSV installed. 

2. Pump is kinetic energy type and incapable of generating a head greater than the maximum allowable 
working pressure of the discharge piping. 

f. Pressure Safety Valves (PSV)— other pumps. 

1. PSV installed. 

2. Maximum pump discharge pressure is less than the maximum allowable working pressure of discharge 
piping. 

3. Pump has internal pressure relief capability. 

4. Pump is a glycol powered glycol pump, and the wet glycol low pressure discharge piping is rated higher than 
the maximum discharge pressure. 

5. Pump is a glycol powered glycol pump, and the wet glycol low pressure discharge piping is protected by a 
PSV on a downstream component that cannot be isolated from the pump. 

g. Check Valve (FSV)— all pumps. 

1 . Check valve installed. 
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Table B-1 — Composite Safety Analysis Checklist (SAC) (Continued) 
A.8 Compressors 

a. High Pressure Sensor (PSH)— suction. 

1. PSH installed. 

2. Each input source is protected by a PSH that will also protect the compressor. 

b. High Pressure Sensor (PSH)— discharge. 

1. PSH installed. 

2. Compressor is protected by a downstream PSH, located upstream of any cooler, that cannot be isolated from 
the compressor. 

c. Low Pressure Sensor (PSL) — suction. 

1. PSL installed. 

2. Bach input source is protected by a PSL that will also protect the compressor. 

d. Low Pressure Sensor (PSL)— discharge. 

1. PSL installed. 

2. Compressor is protected by a downstream PSL that cannot be isolated from the compressor. 

e. Pressure Safety Valve (PSV)— suction. 

1. PSV installed. 

2. Each input source is protected by a PSV that will also protect the compressor. 

f. Pressure Safety Valve (PSV)™ discharge. 

1. PSV installed. 

2. Compressor is protected by a downstream PSV, located upstream of any cooler, that cannot be isolated from 
the compressor. 

3. Compressor is kinetic energy type and incapable of generating a pressure greater than the maximum allow- 
able working pressure of the compressor or discharge piping. 

g. Check Valve (FSV)— final discharge. 

1. PSV installed. 

h. High Temperature Sensor (TSH). 

1. TSH installed. 

A.9 Pipelines 

a. High Pressure Sensor (PSH). 

L PSH installed. 

2. Delivering pipeline protected by PSH located on upstream component. 

3. Each input source is protected by a PSH that also protects a departing or bidirectional pipeline. 

4. The pipeline is protected by a PSH located on a parallel component. 

b. Low Pressure Sensor (PSL). 

L PSL installed. 

2. Delivering pipeline protected by PSL located on upstream component. 

3. Each input source is protected by a PSL that also protects a departing or bidirectional pipeline. 

4. The pipeline is protected by a PSL located on a parallel component. 

c. Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Pipeline has a maximum allowable operating pressure greater than the maximum pressure of any input 
source. 

3. Each input source having a pressure greater than the maximum allowable operating pressure of the pipeline 
is protected by a PSV set no higher than the maximum allowable operating pressure of the pipeline. 

4. The pipeline docs not receive input from the platform process. 

5. Input source is a wcll(s) having a pressure greater than the maximum allowable operating pressure of the 
pipeline and is equipped with two SDVs (one of which may be the SSV) controlled by independent PSHs con- 
nected to separate relays and sensing points. Other input sources having a pressure greater than the maximum 
allowable operating pressure of the pipeline arc protected by PSV. 

d. Check Valve (FSV). 

1. FSV installed. 

2. Departing pipeline is equipped with an SDV controlled by a PSL. 

3. Each input source is protected by an FSV located so that no significant length of pipeline is unprotected 
from backfiow. 

4. Pipeline is used for bidirectional flow. 
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Table B-1— Composite Safety Analysis Checklist (SAC) (Continued) 
_____ Heat Exchangers 

a. High Pressure Sensor (PSH). 

1. PSH installed. 

2. Input source to heat exchanger section cannot develop pressure greater than the maximum allowable work- 
ing pressure of the heat exchanger section. 

3. Each input source is protected by a PSH that also protects the heat exchanger section. 

4. A PSH is installed on a downstream component and cannot be isolated from the heat exchanger section by 
block or regulating valves. 

b. Low Pressure Sensor (PSL). 

1. PSL installed. 

2. Minimum operating pressure is atmospheric pressure when in service. 

3. PSL installed on another component will provide necessary protection and the PSL cannot be isolated from 
the heat exchanger section when the heat exchanger is in service. 

c. Pressure Safety Valve (PSV). 

1. PSV installed. 

2. Each input source is protected by a PSV set no higher than the maximum allowable working pressure of the 
heat exchanger section and a PSV is installed on the heat exchanger section for fire exposure and thermal relief. 

3. Each input source is protected by a PSV that is set no higher than the maximum allowable working pressure 
of the heat exchanger section and that cannot be isolated from the heat exchanger section. 

4. PSVs on downstream equipment can satisfy relief requirement of the heat exchanger section and cannot be 
isolated from the heat exchanger section. 

5. (Deleted in Fourth Edition.) 

6. Input sources to the heat exchanger section cannot develop pressure greater than the maximum allowable 
working pressure of the heat exchanger section and the heat exchanger section cannot be ovcrprcssurcd due to 
temperature or pressure in the other section. 

7. Each input source is protected by a PSV set no higher than the maximum allowable working pressure on the 
heat exchanger section and the heat exchanger section cannot be ovcrprcssurcd due to temperature or pressure 
in the other section. 
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Figure B-1 — Safety Analysis Function Evaluation Chart (SAFE) 



APPENDIX C— SUPPORT SYSTEMS 



Emergency Support Systems (ESS) and other support sys- 
tems provide a method of performing specific safety func- 
tions common to the entire platform. The ESS includes ESD, 
fire detection, gas detection, ventilation, containment systems 
and sumps, and SSSV systems. These are essential systems 
that provide a level of protection to the facility by initiating 
shut-in functions or reacting to minimize the consequences of 
released hydrocarbons. 

The other support systems include the pneumatic supply 
systems, systems for discharging gas to the atmosphere, sys- 
tems for containing leaks or spills, and any other service sys- 
tem that might enhance platform safety. The pneumatic 
supply system provides a control medium for the safety sys- 
tem, and the systems for discharging gas to the atmosphere 
provide a means of discharging gases to the atmosphere under 
safe, controlled conditions. 

C.1 Emergency Support Systems (ESS) 

C.1.1 EMERGENCY SHUTDOWN (ESD) SYSTEM 
C. 1.1.1 Purpose 

An Emergency Shutdown (ESD) system is a system of 
manual control stations strategically located on a platform 
that, when activated, will initiate shutdown of all wells and 
other process stations. This system may include a number of 
independent process shutdown systems that can also be actu- 
ated separately. Activation of the ESD system should result in 
the termination of all production activity on the platform, 
including the closing of all pipeline SDVs. The ESD system 
should be designed to permit continued operation of electric 
generating stations and fire fighting systems when needed in 
an emergency. 

The ESD system provides a means for personnel to manu- 
ally initiate platform shutdown when an abnormal condition 
is observed. Fusible elements of the fire loop may be inte- 
grated with the ESD control loop. 

C.1.1. 2 Shutdown Stations 

Stations for activation of the ESD system for complete 
platform shutdown should be located as follows: 

a. Helicopter decks. 

b. Exit stairway landings at each deck level. 

c. Boat landings. 

d. At the center or each end of a bridge connecting two 
platforms. 

e. Emergency evacuation stations. 

f. Near the driller's console during drilling and workover 
operations. 

g. Near the main exits of living quarters. 



h. Other locations as needed to provide stations accessible to 
all platform areas. 

ESD stations should be conveniently located but should be 
protected against accidental activation. ESD stations should 
be identified by shutdown function, and the shutdown posi- 
tion should be clearly indicated. The manually operated ESD 
valve should be quick-opening and non- restricted to enable 
rapid actuation of the shutdown system. Electric ESD stations 
should be wired as de-energise to trip or as supervised cir- 
cuits. Because of the key role of the ESD system in the plat- 
form safety system, all ESD components should be of high 
quality and corrosion resistant. ESD stations at boat landings 
may utilize a loop of synthetic tubing in lieu of a valve or 
electric switch. 

C.1 .2 FIRE DETECTION SYSTEM 
C. 1.2.1 Purpose 

A method of automatically detecting fires on an offshore 
platform should be provided to allow for early response. 
Pneumatic fusible element (TSE) systems or various electri- 
cal fire detection devices, including flame (USH), thermal 
(TSH), or smoke (YSH) detection devices, should be installed 
in all areas classified (Division 1 or 2) by API Recommended 
Practice 500 and in all buildings where personnel regularly or 
occasionally sleep. 

C.1. 2.2 Pneumatic Fusible Element Systems 

One reliable and widely used method of detecting fires is a 
pneumatic line containing strategically located fusible ele- 
ments. This system should be capable of providing a signal to 
shut down production activities except for equipment 
required to control the fire. Fusible elements normally are 
metallic plugs that melt at a designed temperature or a section 
of fusible synthetic tubing. 

C.1. 2. 3 Electrical Fire Detection Systems 

In addition to pneumatic fusible element systems, various 
electrical fire detection devices (flame, thermal, and smoke) 
are commonly used on offehore production platforms. These 
devices are utilized to activate alarms, initiate shut-in actions, 
or activate fire suppression systems (e.g., CO2, or water). 

C.1. 2.4 Installation and Operation 

All electrical fire detection devices should be approved by 
a nationally recognized testing laboratory and installed in 
accordance with manufacturer's recommendations. Electrical 
fire detection devices should be capable of operating a mini- 
mum of 8 hours without primary platform electrical power. 
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The installation and operation of a fire detection system 
should be suitable for the area it is designed to protect. Fire 
detection systems should be installed for process equipment, 
enclosed classified areas, and enclosed unclassified areas as 
follows: 

a. Process equipment. Table C-l presents guidelines for the 
installation of fusible plugs. When fusible tubing or other 
devices (e.g., ultraviolet flame detectors, infrared sensors, 
etc.) are used in lieu of fusible plugs, they should provide at 
least the same coverage as outlined in Table C-L Fusible ele- 
ments may be installed in the various pneumatic lines of the 
safety system if the signal generated initiates the proper shut- 
in functions. Fusible elements should not be installed in a 
combustible gas supply line that would continue to bleed after 
shutdown. 

b. Enclosed classified areas. Enclosed areas that are classi- 
fied (Division 1 or Division 2) by API Recommended Prac- 
tice 500 should be equipped with fire (flame, thermal, or 
smoke) detection devices that automatically shut in the 
hydrocarbon sources causing the enclosed areas to be classi- 
fied. A fusible plug system using either combustible or non- 
combustible gas is acceptable in these areas. 

c. Enclosed unclassified areas. All rooms in which personnel 
regularly or occasionally sleep should be equipped with 
smoke detectors that activate an audible alarm. Rooms con- 
taining heat sources (e.g., water heaters, clothes dryers, 
kitchen ranges, ovens, space heaters, etc.) should be equipped 
with smoke and/or thermal rate of rise detectors that activate 
an audible alarm. Fusible plug systems utilizing a combusti- 
ble gas should not be used for fire detection in buildings 
where personnel regularly or occasionally sleep (even if the 
building is classified because of its proximity to a hydrocar- 
bon source). 

C.1 .3 COMBUSTIBLE GAS DETECTION SYSTEM 

C. 1.3.1 Purpose 

The accumulation of combustible gases in the atmosphere 
on offshore platforms could create a threat to safety. Accumu- 
lations are more likely to occur in enclosed areas. Two meth- 
ods for increasing safety are providing adequate ventilation 
and installing combustible gas detector systems. The gas 
detector (ASH) system should alert personnel by audible and/ 
or visual alarm to the presence of low level concentrations of 
flammable gas or vapor. Also, it should either shut off the gas 
source or remove all sources of ignition if the concentration 
approaches the lower explosive limit (LEL) of the gas 
present. 

C. 1.3.2 Installation 

Combustible gas detecting sensors should be located (a) in 
all enclosed areas that are classified (Division 1 or Division 2) 



by API Recommended Practice 500, (b) in all enclosed areas 
that contain natural gas-fueled prime movers, and (c) in build- 
ings where personnel regularly or occasionally sleep and that 
contain a flammable gas source. Gas detection instruments 
should be approved by a nationally recognized testing labora- 
tory (NRTL) and should meet requirements put forth by 
ANSI/ISA S12.13, Part I: Performance Requirements, Com- 
bustible Gas Detectors. Shutdown devices controlled by gas 
detector systems should be "normally energized" (commonly 
referred to as "fail-safe"). Gas detection systems should be 
installed, operated, and maintained in accordance with ANSI/ 
ISA SI 2. 13, Part II: Installation, Operation, and Mainte- 
nance of Combustible Gas Detection Instruments. 

In enclosed areas containing flammable gas compressors, 
the minimum number of sensors is one per compressor unit, 
plus an additional sensor per three units or fractional part 
thereof. 

Note: This requires a minimum of two sensors in all enclosed com- 
pressor buildings, in enclosed areas containing other natural gas- 
fueled prime movers (e.g., engines driving generators or pumps), the 
minimum number of sensors is one per prime mover. 

Providing adequate ventilation (refer to C. 1.4) is an accept- 
able alternative to installing gas detection systems except in 
buildings where personnel regularly or occasionally sleep, or 
in enclosed areas that contain compressors handling flamma- 
ble gas. Likewise, gas detection may be omitted in enclosed 
areas on platforms not provided with continuous AC power if 
the enclosed area contains no ignition source, contains no 
compressor handling flammable gas, and is not a building 
where personnel regularly or occasionally sleep. 

C.1 .3.3 Operation and Maintenance 

Gas detection instruments should be able to detect at least 
two gas concentration levels. An audible alarm signal (visual 
signal in high noise areas where an audible alarm is ineffec- 
tive) should be activated at no greater than 25 percent LEL to 
alert operating personnel. Automatic corrective action, e.g., 
closing SDVs on gas sources or disconnecting electrical 
power to equipment not suitable for locations classified as 
hazardous, should be initiated at no greater than 60 percent 
LEL. In lieu of total process shut in, it is acceptable to isolate 
alarmed areas; an example is closing a fuel valve to a genera- 
tor building. Careful consideration should be given to the 
form of automatic corrective action taken to ensure that the 
situation is not made more hazardous. If machinery or equip- 
ment shutdown could create an ignition source, consideration 
should be given to actuation of a fire inerting system, e.g., 
Hal on, prior to shutdown. Gas detection systems monitoring 
more than one area should identify the location where flam- 
mable gas or vapor is detected. 

Note: In special cases, detection at lower concentrations is required 
to comply with the provisions of API Recommended Practice 500, 
to reduce the area classification. 
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C.1.4 ADEQUATE VENTILATION 

Adequate ventilation is ventilation (natural or artificial) 
that is sufficient to prevent the accumulation of significant 
quantities of vapor-air mixtures in concentrations above 25 
percent of their lower explosive limit (LEL). Refer to API 
Recommended Practice 500 for additional details, including 
recommended methods of achievement. 

C.1 .5 CONTAINMENT SYSTEM 

A containment system is installed to collect and direct 
escaped liquid hydrocarbons to a safe location. All equipment 
subject to leaks or overflow should be protected by curbs, gut- 
ters, or drip pans that drain to a sump. Containment systems 
are optional on structures that do not have process vessels or 
other equipment subject to leak or overflow (e.g., structures 
with only wells, headers, pipelines, cranes, and/or instrument 
gas scrubbers). 

All gravity drain piping networks should be designed to 
prevent escape of gas from sumps through the drains. This is 
typically accomplished by water seals located at each drain, 
or each drain pipe header, or with a total network water seal 
located in the sump inlet piping. Check valves are not consid- 
ered appropriate for this service and should not be used as 
alternative protection for water seals. Pressure drains should 
not be combined with gravity drains prior to sump entry. 

C.1.6 SUMPS 
C. 1.6.1 General 

A sump may be a tank, a closed-end pile, or an open-end 
pile. All sumps should be equipped with an automatic dis- 
charge to handle maximum inflow. Vents are installed on 
atmospheric sumps for the purpose of safely dissipating 
hydrocarbon vapors. Depending upon design and location, a 
sump pile vent may fulfill this purpose without a flame arres- 
tor being installed. Due to possible plugging from corrosion, 
the low flow/low pressure (no static electricity), and distance 
from potential ignition/flash back sources, a flame arrestor 
could be eliminated in a sump pile located close to the water 
level. 

C. 1.6.2 Open-end Sump Piles 

Properly designed open-end sump piles are occasionally 
used to collect deck drainage or drips and to dispose of 
treated produced water. Except during emergency upset con- 
dition, vessels (e.g. flare scrubbers, condensate accumulators, 
and various fuel filter scrubbers) should not discharge liquid 
hydrocarbons directly into an open-end sump pile. Open-end 
sump piles should be protected against hydrocarbon dis- 
charge (overflow and/or underflow). The type of protection 
should be determined on a case-by-case basis. Some factors 



that should be considered include pile length, liquid proper- 
ties, maximum inflow rate, wave action, and tidal fluctuation. 

C.1 .7 SUBSURFACE SAFETY VALVES (SSSVs) 

SSSVs are installed below r the wellhead to prevent uncon- 
trolled well flow in the event of an emergency situation. Sub- 
surface controlled SSSVs (SSCSV) should shut in if well rate 
exceeds a predetermined rate that might indicate a large leak. 
Surface controlled SSSVs (SCSSV) should shut in when acti- 
vated by an ESD system and/or a fire loop. Guidance for the 
design and installation of SSSVs is covered in API Recom- 
mended Practice 14B. 

C.2 Other Support Systems 

C.2.1 PNEUMATIC SUPPLY SYSTEM 

C.2. 1.1 Purpose 

The pneumatic supply system provides the control medium 
for the surface safety system. The platform safety and shut- 
down systems generally require a power supply at a pressure 
adequate to operate valve actuators and an instrument supply 
at a lower pressure. 

C.2. 1.2 Pneumatic Supply Properties 

Proper functioning of the safety system is dependent on the 
pneumatic supply; therefore, a reliable source of high quality 
gas is essential. The following are properties of a good pneu- 
matic supply: 

a. Free of liquid hydrocarbons. 

b. Free of water and water vapor. 

c. Free of solids. 

d. Non-corrosive. 

C.2. 1.3 Pneumatic Supply Sources 

Usually, air, natural gas, or nitrogen is the pneumatic con- 
trol medium. When air is used as a pneumatic supply source, 
the system should be designed to prevent the mixing of air 
and hydrocarbon gases from the process or utility systems 
under both normal and abnormal conditions. If an alternate 
pneumatic supply source is provided, the alternate medium 
must be of a composition that will not create a combustible 
mixture when combined with the primary source. 

C.2. 1.4 Supply and Response 

The pneumatic supply distribution systems should be sized 
to assure adequate volume and pressure to all safety devices. 
Pneumatic supply usage should be calculated for the maxi- 
mum condition that could be experienced at any one time. 
The time it takes for any safety device (e.g. PSH, BSL, ESD 
station, etc.) to effect component or platform shutdown 
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should not exceed 45 seconds. To achieve this response, con- 
sideration should be given to pneumatic line sizes, safety 
device bleed port size and the use of auxiliary quick bleed 
devices. Pneumatic lines that supply and bleed should be 
sized for optimum bleed conditions. Because of volume and 
flow characteristics a line that is either too large or too small 
will require excessive time to bleed. API Recommended 
Practice 550 should be used as a guide when designing instru- 
ment and control systems. 

C.2.2 SYSTEMS FOR DISCHARGING GAS TO 
ATMOSPHERE 

C.2.2.1 Purpose 

Systems for discharging gas to the atmosphere provide a 
means for conducting discharged gas from process compo- 
nents under normal conditions (flare, vent) and abnormal con- 
ditions (relief) to safe locations for final release to the 
atmosphere. These should be locations where the gas will be 
diluted with air to below the LEL so it will not be a threat to 
the facility or where it can safely be burned. 

C.2.2. 2 Description 

These systems originate at the normal gas exit or pres- 
sure relief device of a process component and terminate at 
the designated safe locations. They can vary from an exit 
nipple on an individual PSV or control valve to a piping 
network connected to the outlet of several valves. If gas is 
discharged from a pressure vessel during normal operation 
(flare, vent), a scrubbing vessel should be provided to 
remove liquid hydrocarbons. 



C.2.2. 3 Discharge Point 

The final discharge point for atmospheric gas may be 
through a vertical, cantilevered, or underwater pipe, in some 
cases the discharge point may be remote from the platform. 
The following should be considered in selecting a safe dis- 
charge point: 

a. Personnel safety. 

b. The discharge volume. 

c. The location in relation to other equipment, particularly 
fired vessels or other ignition sources, personnel quarters, 
fresh air intake systems, and helicopter and boat 
approaches. 

d. Prevailing wind direction and, in the case of underwater 
discharges, the prevailing current. 

C.2.2.4 Design Considerations 

Atmospheric gas discharge systems should be designed 
in accordance with API Recommended Practice 520 and 
API Recommended Practice 521, API Specification 2000, 
and Section VIII of the ASME Boiler and Pressure Vessel 
Code. Systems should be designed so that back pressure, 
including inertial forces developed at maximum instanta- 
neous flow conditions, will not exceed the working pres- 
sure of the lowest pressure rated item. Flame arrestors can 
be used in vent systems to reduce the danger of combus- 
tion within the component from an external source. A flare 
scrubber should be a pressure vessel designed to handle 
maximum anticipated flow. 
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Table C-1— Guidelines for Fusible Plug Installations 



Component 



Fusible Plug Arrangement 



Minimum Number of Plugs 



Wellheads 

Headers 

Pressure vessels: 
Vertical vessel 

Horizontal vessel 



Atmospheric vessels 

Fired vessels and exhaust 
heated components 

Heat exchangers (shell-tube) 

Pumps: 

Reciprocating 

Centrifugal 

Compressors: 
Reciprocating 

Centrifugal 

Engines: 

Spark ignition 



One for each wellhead b 

One for each 10 feet (3m) of header length b 

One for each 12 inches (0.3m) of OD to a 
maximum of five. 

a. Less than 48 inches (1.2m) OD— One 
for each 5 feet (1 .5m) of length. 

b. Greater than 48 inches ( 1 .2m) OD — two 
for each 5 feet ( 1 ,5m) of length in two par- 
allel rows. 

One for each vessel process inlet, outlet, 
and hatch. 

Same as pressure vessels. Additionally, 
one outside the flame arrestor on fired 
components. 

One for each end of heat exchanger. 

One over rod packing. 
One over each packing box. 

One for each cylinder a 
One over compressor case. 

One over each carburetor or fuel injection 
valve a 



Diesel 

Combustion turbines 



One for pump supplying injectors a - 

One for each fuel solenoid, governor — 

valve, and PTO pump 

a Or equivalent coverage. 

h Not applicable to underwater wellheads or headers. 

Note: When fusible tubing or other devices (such as ultraviolet flame detectors, etc.) are used instead of fusible plugs, 

they should 

provide at least the same coverage as outlined above. 



APPENDIX D— TESTING AND REPORTING PROCEDURES 



Performance testing provides a practical method of con- 
firming the system's ability to perform the design safety func- 
tions. On initial installation, tests should be conducted to 
verify that the entire system, including the final shutdown 
valve or control device, is designed and installed to provide 
proper response to abnormal conditions. Thereafter, periodic 
operational tests should be performed, at least annually, to 
substantiate the integrity of the entire system, including pro- 
cess station or platform shutdown, if necessary. Specific test 
procedures for individual safety devices are presented in 
Table D-2. A reporting method should provide for orderly 
accumulation of test data that can be used for operational 
analyses, reliability studies, and reports that may be required 
by regulatory agencies. 

D.1 Design and Installation Verification 

D.1.1 PURPOSE 

Before a production system is placed in initial operation, or 
when re-commissioning a platfonn after being shut in for 30 
days or more, or when a modification is made to the platform 
safety system, the complete safety system should be thor- 
oughly checked to verify that each device is installed, opera- 
ble, performs its design function and, if applicable, is 
calibrated for the specific operating conditions. 

D.1.2 SAFETY ANALYSIS FUNCTION 
EVALUATION (SAFE) CHART 

The Safety Analysis Function Evaluation (SAFE) chart 
shown in Figure B-l of Appendix B and discussed in 4.3.3 
provides a checklist for the initial design and installation veri- 
fication. Each sensing device is listed in the column headed 
"DEVICE I.D. " and its respective control function is indi- 
cated under the column headed "FUNCTION PER- 
FORMED." It must be determined that a safety device is 
operable, properly calibrated, and accomplishes the design 
control function within the prescribed time period. This fact 
can be noted on the SAFE Chart. When all initiating devices 
have been tested and their "function performed" confirmed, 
the design and installation is verified. 

D.2 Safety System Testing 

D.2.1 PURPOSE 

Safety Systems should be tested to verify that each sensing 
device operates within established limits and the control cir- 
cuit performs its shutdown function as specified. Testing is 
required to maintain the reliability of the safety system; in 
systems subjected to higher stresses (corrosion, heat, etc.), 



test intervals may need to be shortened to maintain the reli- 
ability of the system. 

D.2.2 FREQUENCY 

Safety devices and systems should be tested at specified 
regular intervals at least annually. Recommended test inter- 
vals for pressure safety high and pressure safety low sensors 
(PSHLs) and level safety high and level safety low sensors 
(LSHLs) are as follows: 

Monthly (once each calendar month) 

(1) PSHLs (pneumatic/electronic switch) 

(2) LSHLs (pneumatic/electronic switch/electric analog 
with mechanical linkage) 

Quarterly (Every third calendar month) 

(1) PSHLs (Electronic analog transmitters connected to 
programmable electronic systems) 

(2) LSHLs (Electronic analog transmitters connected to 
programmable electronic systems) 

It should be noted that these recommended test intervals do 
not supersede the testing requirements for testing safety sys- 
tems when initially installed or modified as outlined in Para- 
graph D. L 1 of this appendix. 

Alternative test intervals may be established based on field 
experience, operator's policy, or governmental regulations. 
In order to establish a alternative test interval beyond the fre- 
quency recommended herein or outside of those dictated by 
governmental regulations, the alternative test interval should 
ensure device reliability equal to or greater than the reliability 
demonstrated by the recommended/required test frequency. 
The following parameters should be verified and documented 
in order to justify use of such a test interval: 

1. A statistical analysis of the test history of the specific 
devices to develop a device failure probability, or con- 
versely, device reliability, and should likewise define the 
optimum test frequency to insure device repeatability. 

2. A comprehensive historical testing record for each 
device to support the statistical analysis. The historical 
records should be maintained in a database that records 
and reports the results of the device testing and inspection. 

3. A monitoring program based on the results of the sta- 
tistical analysis to establish acceptance criteria for devices 
in this program as well as methods to continuously moni- 
tor, review and update test results to verify that the 
established level of device reliability is maintained. 

D.2.3 SENSOR TESTING 

Safety device tests should confirm that sensors properly 
detect the abnormal conditions and transmit a signal to per- 
form specific shutdown functions. Sensors are usually tested 
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by simulating an abnormal condition that the device senses to 
initiate shutdown functions. 

D.2.4 SHUTDOWN DEVICE AND CONTROL 
CIRCUIT TESTING 

Shutdown valves and other shutdown controls should be 
tested to ensure they receive the signal transmitted by the sen- 
sor and perform their design function. Before testing a sensor, 
the final shutdown or control device activated by the sensor 
may be de-activated or bypassed to prevent actual shutdown 
of the process station or platform. However, the entire shut- 
down or control circuit, including the final shutdown valve or 
control device, should be tested at least annually. 

D.2.5 AUXILIARY DEVICES 

All auxiliary devices in the safety system between the 
sensing device and the final shut-in device should be tested at 
least annually to verify the integrity of the entire shutdown 
system. These devices, including master or intermediate pan- 
els, should be tested in addition to the sensing devices. 

D.2.6 INSTALLATION FOR TESTING 

Devices should be installed with operational testing in 
mind. Test bypasses may be installed so that individual 
devices or entire circuits can be tested without actual shut- 
downs. Safety devices should be located for easy access, and 
multiple device test manifolds and quick connect fittings 
should be considered to minimize test time. Consideration 
must be given to platform and safety systems design and 
operation while safety devices are bypassed. 

D.2.7 TEST PROCEDURES 

Due to the varied makeup of individual shutdown systems 
and control circuits, no attempt is made here to describe the 
steps for testing these systems. However, the individual oper- 
ators should be responsible for identifying these procedures 
for each installation. Testing of common safety devices 
should be performed in accordance with test procedures 
shown in Table D-2. 

a. The many types and models of safety devices preclude 
detailed procedures for each; however, general test proce- 
dures for the principal types will cover most safety devices. If 
a device in use is not covered or does not fit the general pro- 
cedures, specific test procedures should be developed by the 
operator. 

b. Because of the many possible equipment arrangements, 
test procedure steps to deactivate a shutdown or control 
device or to take a component out of service during testing 
are not given. Devices or equipment taken out of service for 
testing should be clearly tagged to minimize the possibility of 
their being left in an inactive condition. 



D.2.8 PERSONNEL QUALIFICATION 

Testing of surface safety systems should be performed only 
by a qualified person. 

D.2.9 DEFICIENT DEVICES 

A safety device that fails, malfunctions, or is otherwise 
found inoperable during the test procedure should be 
promptly replaced, repaired, adjusted, or calibrated, as appro- 
priate. Until such action can be completed, the device should 
be clearly tagged as inoperable and equivalent surveillance 
should be provided, the process component taken out of ser- 
vice, or the platform shut in. 

D.3 Test Tolerances 

D.3.1 SAFETY RELIEF VALVE (PSV) 

PSV set pressure tolerances are plus or minus 2 psi (14 
kPa) for pressure up to and including 70 psi (480 kPa), and 
plus or minus 3 percent for pressure above 70 psi (480 kPa). 

D.3.2 HIGH AND LOW PRESSURE SENSOR 
(PSHL) 

PSHL set pressure tolerance for set pressures greater than 5 
psi (35 kPa) is plus or minus 5 percent or 5 psi (35 kPa), 
whichever is greater; however, the trip pressure should not 
exceed the pressure rating of the equipment protected. A 
PSHL with a set pressure of 5 psi (35 kPa) or less must func- 
tion properly within the service range for which it is installed. 

D.3.3 HIGH LEVEL SENSOR (LSH) 

An LSH must operate with sufficient remaining volume in 
vessel to prevent carry-over before shut in. Test tolerance for 
analog level transmitters is ±3 inches (7.5 cm) of the LSH set 
point. 

D.3.4 LOW LEVEL SENSOR (LSL) 

An LSL must operate with sufficient liquid volume above 
the highest liquid discharge to prevent gas discharge into liq- 
uid outlet before shut in. Test tolerance for analog level trans- I 
mitters is ±3 inches (7.5 cm) of the LSL set point. | 

D.3.5 COMBUSTIBLE GAS DETECTOR (ASH) 

ASH set point tolerance is plus or minus 5 percent of full 
scale reading; however, the trip point must not exceed 60 per- 
cent of LEL at the high level setting or 25 percent of LEL at 
the low level setting. 

D.3.6 FLOW LINE CHECK VALVE (FSV) 

Flowline FSVs should be tested for leakage. If sustained 
liquid flow exceeds 400 cc/min. or gas flow exceeds 15 cubic 
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feet/min. (0.4 cubic meter/min.), the valve should be repaired 
or replaced. 

D.3.7 HIGH AND LOW TEMPERATURE SENSOR 
(TSHL) 

If temperature devices are used to initiate shutdown in the 
event of fire or surface temperatures approaching ignition 
temperature, the danger point is usually much higher than 
normal operating temperature. Thus, the instrument may be 
checked at one point on the scale, as described in Table D-2, 
and the set point adjusted sufficiently below the danger point 
to assure that any working instrument will operate before 
reaching the danger point. If the set temperature is near the 
operating temperature range, specific test tolerances should 
be established. Calibration and testing procedures discussed 
in this section are not applicable to eutectic devices. 

D.3.8 TOXIC GAS DETECTOR (OSH) 

OSH set point tolerance shall not vary from the test gas 
concentration (known to a tolerance of 5 percent or 1 ppm, 
whichever is greater) by more than 2 ppm or 1.0 percent. 



D.4 Reporting Methods 

D.4.1 PURPOSE 

Safety device test result records should be maintained in a 
manner that will enable the performance of operational analy- 
ses and equipment reliability studies, and the providing of 
reports that are required by regulatory agencies. These 
records should document that standards and regulatory 
requirements are met. 

D.4.2 TEST INFORMATION 

The minimum test information for different safety devices 
is shown in Table D-l. Test results and operating conditions 
must be recorded to adequately assess the performance of 
safety devices. 

D.4.3 DEFICIENT DEVICES 

Records of deficient devices are essential for reliability 
analyses. As a minimum, the record should include the cause 
of the deficiency in addition to the data required in Table D- 1 . 







Table D-1 — Safety Device Test Data Safety Device 
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Table D-2 — Safety Device Test Procedures 

a. Burner Flame Detector (BSL). 

1 . To check pilot flame-out control: 

(a) Light pilot. 

(b) Block fuel supply to main burner. 

(c) Shut o(T fuel supply to pilot and check BSL for detection. 

2. To check burner flame-out control: 

(a) Light main burner. 

(b) Block fuel supply to pilot. 

(c) Shut ofT fuel supply to main burner and check BSL for detection. 

b. Combustible Gas Detector (ASH). 

1. Adjust the zero control, if necessary, so that meter reads 0% LEL with all gas positively eliminated from 
sensor. 

2. Place sensing adapter of portable purge calibrator over probe head and open shut-off valve on sample 
container. 

3. When meter reaches maximum level and stabilizes, record meter reading, calibration gas concentration, low 
alarm and high shutdown set points (% LEL). 

4. If necessary, adjust meter to read % LEL of calibration gas. 

5. Close shut-off valve on sample container and remove sensing adapter. 

6. Actuate test control or zero control, as appropriate, and observe low and high trip points. Check shutdown 
relay for actuation. 

c. Emergency Shutdown System (BSD). 

1 . Operate a manual remote station, preferably one at the boat landing, and observe that appropriate shut in 
relays operate. This may be done individually or as a group, depending on platform design, in order to avoid 
actual platform shutdown, unless desired. Record the time (seconds) after operating the manual remote station 
for a flowlinc surface valve to close. 

2. Check each BSD station by moving valve handle to the shutdown position. Observe for free valve movement 
and unobstructed gas bleed. Limit bleed to prevent actual shutdown. 

d. Flow Line Check Valve (FSV). 

1 . Close upstream valve and associated header valves. 

2. Open bleeder valve and bleed pressure from flow line between closed valves. 

3. Close bleeder valve. 

4. Open appropriate header valve. 

5. pen bleeder valve. 

6. heck bleed valve for back flow. If there is a continuous backflow from bleeder valve, measure the flow rate. 
Rate should not exceed 400 cc/min. or 15 cubic fect/min. (0.4 cubic mcter/min.) 

7. Close bleeder valve and open upstream valve. 

c. High and Low level Sensors (LSH) and (LSL)— installed internally. 

1 . Manually control vessel dump valve to raise liquid level to high level trip point while observing level liquid 
in gauge glass. 

2. Manually control vessel dump valve to lower liquid level to low level trip point while observing liquid level 
in gauge glass. 

Alternate procedure 1 : 

1 . Open fill line valve and fill vessel to high level trip point. 

2. Close fill line valve. 

3. Drain vessel to low level trip point. 

Alternate procedure 2; (for pressure differential transmitter used for level sensors) 

Note: Source pressures utilized for testing transmitters must be external sources separate from the process, utilizing 

test gauges to observe trip points and verify the zero and span of the transmitters. 

1 . Close valve connecting high side of transmitter to vessel. 

2. Close valve connecting low side of transmitter to vessel. 

3. Connect external test pressure source to high side of transmitter. External pressure source shall have means 
to measure pressure (or equivalent level) utilizing an external test gauge. 

4. Vent to atmosphere low side of transmitter. 

5. Introduce pressure at high side of transmitter equal to high liquid level and verify LSH actuates within test 
tolerance. 

6. Introduce pressure at high side of transmitter equal to low liquid level and verify LSL actuates within test 
tolerance. 

7. Disconnect test pressure source. 

8. Close vent valve of low side of transmitter. 

9. Open valves to vessel and return transmitter to service. 

Note: For transmitters without low side connections to vessel, steps 2,4 and 8 can be omitted, 
f. High and Low Level Sensors (LSH) and (LSL)— installed in outside cages. 

1 . Close isolating valve on float cagc(s). 

2. Fill cagc(s) with liquid to high level trip point. 

3. Drain cagc(s) to low level trip point. 

4. Open cagc(s) isolating valves. 
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Table D-2 — Safety Device Test Procedures (Continued) 

Alternate procedure: 

1 . Close isolating valve on float cagc(s). 

2. Drain cage to low level trip point. 

3. Open lower cage isolating valve. 

4. Slowly bleed pressure from the lop of the cage, allowing vessel pressure to push fluid from inside the vessel 
to the high level trip point. 

5. Open upper cage isolating valve. 

g. High and Low Pressure Sensors (PSH) and (PSL)— external pressure test. 

1 . Close isolating valve on pressure sensing connection. 

2. Apply pressure to sensor(s) with a hydraulic pump, high-pressure gas or nitrogen, and record sensor trip 
pressure observed from an external test gauge. 

3. If sensors arc installed in scries with the high sensor upstream from the low sensor, bleed pressure to reset 
the high sensor. Bleed pressure from sensors and record low sensor trip pressure. 

4. Adjust sensor, if required, to provide proper set pressure. 

5. Open sensor isolating valve. 

h. High and Low Pressure Sensors (PSH) and (PSL)— bench test. 

1 . Mount sensors on a test stand and connect pneumatic supply. 

2. Apply pressure as indicated: 

(a) High pressure sensor (PSH). Apply pressure to sensor with hydraulic pump, high pressure gas or nitro- 
gen bottle, and record high sensor trip pressure. 

(b) Low pressure sensor (PSL). Apply pressure above set pressure and bleed pressure, and record pressure 
at which low sensor trips. 

3. Tag sensor with set pressure and date. 

i. Safety Relief Valve (PS V)— external pressure test. 

1 . Remove lock or seal and close inlet isolating block valve. (Not required for PSVs isolated by reverse buck- 
ling rupture disc or check valve or pilot operated PS Vs.) 

2. Apply pressure through test connection with nitrogen, high pressure gas or hydraulic pump, and record pres- 
sure at which the relief valve or pilot starts to relieve. 

3. The safety valve or pilot should continue relieving down to reseat pressure. Hold test connection intact until 
the pressure stops dropping to ensure that valve has reseated. 

4. Open inlet isolating block valve and lock or seal, 
j. Safety Relief Valve (PSV)— bench test. 

1 . Mount on a test stand. 

2. Apply pressure through test connection with nitrogen, high pressure gas, or a hydraulic pump, and record 
pressure at which the relief valve starts to relieve test pressure. 

3. The safety valve should continue relieving down to reseat pressure. Hold test connections intact until the 
pressure stops dropping to ensure that valve has reseated. 

4. Tag PSV with the set pressure and the date of test. 
k. Pipeline and Process Shutdown Valve (SDV). 

Option I— operation test. 

1 . Bleed pressure off the actuator and allow valve to reach three-quarter closed position. 

2. Return supply pressure to actuator. 

Option 2 — Full valve closure test. 

1 . Initiate signal to close SDV from cither remote or local switch. 

2. Close SDV. 

3. Open SDV 

I. Surface Safety Valve (SSV) operation test. 

1. Shut in well. 

2. Close SSV. 

3. Open SSV. 

4. Return well to production. 

m. Surface Safety Valve (SSV) — pressure holding test. 

1 . Shut in well and SSV as for operations test. 

2. Position wing and flow line valves to permit pressure to be bled o IT downstream of SSV. 

3. With pressure on upstream side of SSV, open bleed valve downstream of SSV and check for continuous 
flow. If sustained liquid flow exceeds 400 cc/min. or gas flow exceeds 15 cubic fect/min. (.4 cubic mcicr/min.) 
during the pressure holding test, the SSV should be repaired or replaced. 

4. Close bleeder valve. 

5. Return well to production. 

n. High and Low Temperature (TSHL)— operation test. 

1 . Adjust set point until controller trips. 

2. Reset controller set point based on observed temperature as follows: 

(a) Indicating controller—Add or subtract the difference between indicated temperature and trip tempera- 
ture to the desired trip temperature. 

(b) N on- indicating controller with graduated dials— Add or subtract the difference between dial reading at 
trip point and actual temperature to calculate the desired trip setting. 

(c) Devices that neither indicate nor have graduated dials— Reset according to manufacturcr'sinstructions. 
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Table D-2 — Safety Device Test Procedures (Continued) 

o. High and Low Temperature (TSHL)— -temperature bath test. 

1 . Remove temperature sensing probe. 

2. Place a thermometer in a hot liquid bath. 

3. insert temperature sensing probe in the liquid bath and set manual dial on temperature controller at the same 
temperature indicated on the thermometer. Record high temperature set point. If the controller docs not trip at 
the temperature of the liquid bath, adjust the controller to trip at that temperature. 

4. Remove temperature sensing probe from liquid bath, allow it to cool, and record low temperature set point. 

5. Remove sensing probe to original location and adjust controller to desired temperature, 
p. Underwater Safety Valve (USV)— combined operation and leakage test. 

Each operator should use a method appropriate to the system that demonstrates the pressure integrity of the USV 
and quantifies leak rates. Following arc two options offered for general guidance only. 

Option 1: 

Perform test as in Table D-2, Item m. 

Option 2: 

1. Shut in well and USV as for operations test (Refer to Table D-2, Items 1.1. & 1.2.) and close downstream 
header or flow line valve. 

2. With pressure on upstream side of USV, measure pressure buildup in the flow line versus time. If the abso- 
lute pressure buildup in the confined line segment downstream of the USV is in excess of that which represents 
a flow rate of 400 cc/min. of liquid or 15 cubic fcet/min, (0.4 cubic mcter/min.,) of gas, the USV should be 
repaired or replaced. An example with calculations is given in Appendix A of API Recommended Practice 14H 

3. Return well to production, 
q. Toxic gas detector (OSH). 

Toxic gas detectors should be tested in accordance with the manufacturer's specifications. 



APPENDIX E— EXAMPLES OF SAFETY ANALYSIS FLOW DIAGRAM AND SAFETY 
ANALYSIS FUNCTION EVALUATION (SAFE) CHART 



E.1 

Figures E-l.l and E-1.2 present a completed safety analy- 
sis flow diagram and a Safety Analysis Function Evaluation 
(SAFE) chart for an example platform production process. 
Each process component is listed on the SAFE chart with its 
recommended safety devices determined from the individual 
components analysis (Appendix A). Each shut down and 
safety function is also listed. For each safety device, a specific 
shut down and/or safety function(s), or a SAC reference 
(Appendix B) should be documented on the SAFE chart. Pro- 
visions are also made for documenting alternate or substitute 
safety devices used in lieu of recommended safety devices. 

The flow diagram (Figure E-l.l) is not intended as a rec- 
ommended method for handling produced fluids, but is 
included for illustrative purposes ouly. 

Section E.2 provides an example method for analysis of a 
natural draft burner on a pressure vessel. Figure E-2.1 shows 
the process component with all possible safety devices prior 
to analysis. Figure E-2.2 shows the resulting component after 
analysis with installed safety devices designated by solid cir- 
cles, and safety devices that have been eliminated with appro- 
priate SAC references indicated by dashed circles. Figure E- 
2.3 is the corresponding SAFE Chart for the analysis. 

E.2 Natural Draft Burner on a Heater 
Treater Pressure Vessel 

To analyze this combination, it is necessary to refer to A.4 
for the pressure vessel and A.6 for the fired component. 



Draw a simplified diagram with all required safety devices 
per A.4 and . A.6 (refer to Figure E-2.1). 

It is suggested that the component identification (refer to 
Table 2-2) for both the vessel and the fired component have 
the same component identifier (e.g., XXX-2000, YYY-2000). 

Using A.4 and A.6 as guidelines, analyze Figure E-2.2. 

Explanation 

The PS.L sensor in the fuel supply line is not required on a 
natural draft burner because of the low air intake pressure. 

The LSL cannot be eliminated because of fire tube expo- 
sure. 

Due to the internal design of the vessel, an additional LSL 
(LSL 2) is required. The blowby of the level control valve 
was calculated and it exceeded the process capacity of the 
downstream component. LSL 2 and an SDV were added to 
protect the downstream component from blowby. 

FSV 3 is not required because the regulator effectively 
minimizes backflow. 

It is not necessary to install two media TSHs in the vessel, 
one for the vessel, the other for the fired component. One 
TSH provides adequate protection, and it is mounted in the 
liquid portion of the vessel. 

Figure E-2.2 represents the heater after analysis. Figure 
E-2.3 is the corresponding SAFE Chart for Figure E-2.2. 



75 



HXAMPli; DEVICE IDENTIFlCATON 


FSV1 


MBD-1000 


FSV2 


MBO-100G 




MBD-1000 


l.SH 1 


MBD-1000 


pshi. 


MBD-1000 


CSV 


MBD-1000 




i'pslV- I (sdv) 



EAW-2000 
Fireri Component 
(Natural Draft) 



/Qs shown on the 
^~( re been eliminated 

^__^;heck list (SAC). 

\& J^shown on the flow 

^rdance with 
shown unless 



API Recommended Practice 14C 



79 



MU-6-009 


SHEET J_OF_6_SHEETS 

FIGURE E. 1.2 

SAFETY ANALYSIS 

FUNCTION EVALUATION CHART 

(SAFE) 




D 

LU 

a: 
o 

LL 
CL 
LU 

a. 

z 
o 

H 
U 

z 

3 

LL 


_J 


_i 


_l 


o 
li 1 

z 

LL 
LL 
O 

h- 
3 
X 
CO 


LU 
3 
LL 
LL 
LL 
O 

h- 

3 
X 
CO; 


O 
_j 

i 

LL 
LL 
O 

H 
ID 
X 
CO 


O 

_j 

LL 

z 

LL 
LL 
O 

H 
ID 
X 
CO 


_i 

LU 
3 
LL 
LL 
LL 
O 

H 
3 
X 
CO 


O 
CO 
(0 
LU 

a: 

Q_ 

o 
u 
z 
5 

O 
Q 

o 

CO 


LU 
3 
LL 
LL 
LL 
O 


O 

_i 

LL 

z 

LL 
LL 
O 


<: 

o 

_J 

LL 

z 

LL 
LL 

P 


LU 
3 
LL 
LL 
LL 
O 


O 

_i 

LL 

Z 

LL 

U. 

O 


_i 
LU 

3 

LL 
LL 
LL 

o 


o 

_l 

LL 

LL 
LL 
O 


0. 

3 
0. 

z 
<: 
O 

Q 




































5 
X 

< 


z 

o 

CO 
CO 

LU 
LU 

< 

_J 

LL 

H 
Z 
LU 
> 
LU 

a: 

Q_ 


Z 

o 

CO 
CO 

LU 

< 

a. 

\- 
z 

UJ 

> 

LU 

en 

QL 


LL 
LU 

_l 
UJ 
QL 

3 
3 
O 
< 
> 


LL 
LU 

LU 
CC 
LU 
Q£ 
=) 
CO 
CO 
LU 
OH 


o 

-J 

LL 

< 

00 
LL 
N, 

Z 
2 








UJ 

z 


LU 

Z 


LU 

z 






H 
3 


3 


3 


PLATFORM IDENTIFICATION 


3 


3 


3 


3 


3 


3 


3 


3 


CO 


CO 


JL 
CO 


CO 


CO 


J_ 
CO 


A. 
CO 


CO 


X 
CO 


_L 
CO 


_L 
CO 




example 




LU 
Z LLJ 

t 

go 


a 

< 


CO 

< 


Q 

CO 

< 


o 
o 
o 

CM 


o 
o 
o 


o 
o 
o 


o 
o 
o 


o 
o 
o 


o 
o 
o 


o 
o 
o 


o 

o 
o 


o 
o 
o 


o 
o 
o 


o 
o 
o 

CM 

0$ 

o 
o 

o 


o 
o 
o 

CO 


o 
o 
o 


o 
o 
o 

CO 
































































1 


o 


> 
< 


o 
m 

2 


5 
< 

LU 


< 

CD 
O 


< 

CD 

o 


< 

DO 
O 


< 

O 


2 

Q_ 


1 


1 


1 

LU 


< 

CO 
LL 


_l 


LL 

s 


< 

CD 

CL 






















































datf- 




















CM 


CO 




,_ 


OJ 




























































RY- 




REVISIONS 


> 

CO 

CO 


> 

CO 
CO 


> 

CO 
CO 


> 

Q 
CO 


> 

Q 
CO 


> 

Q 
CO 


> 

Q 
CO 


> 
Q 
CO 


g 

CO 


> 

Q 
CO 


> 

O 
CO 


> 

a 

CO 


> 

Q 
CO 


> 

Q 
CO 


> 

Q 
CO 


> 

Q 
CO 


> 

Q 
CO 
















































PROCESS COMPONENT 


DEVICE 
ID. 


ALTERNATE PROTECTION 




IDENT- 
IFICATION 


SERVICE 


SAC REF 
NUMBER 


ALTERNATE DEVICE \ 
IF APPLICABLE \ 


FA1 


A14D 


UPSTREAM 
FLOWLINE SEG. 


PSH 




A.1A.2 


PSH 




FA2 


A14D 


















































































PSL 














• 
















































































PSV 




A.1C.2 


























































































FSV 




A.1D.2 


FSV 




FA2 


A14D 
















































































































































































FA2 


AMD 


DOWNSTREAM 
FLOWLINE SEG. 


PSH 














• 
















































































PSL 














• 
















































































PSV 




A.1C.2 


























































































FSV 




























































































• 
































































































FA1 


A9T 


UPSTREAM 

FLOWLINE SEG. 


PSH 




A.1A.2 


PSH 




FA2 


A9T 


















































































PSL 




A.1B.2 


























































































PSV 




A.1C.2 


























































































FSV 




A.1D.2 
























































































































































































FA2 


A9T 


DOWNSTREAM 
FLOWLINE SEG. 


PSH 
















• 














































































PSL 
















• 














































































PSV 


























































































• 




FSV 




























































































o 
































































































FA1 


A3D 


UPSTREAM 

FLOWLINE SEG. 


PSH 




A.1A.2 


PSH 




FA2 


A3D 


















































































PSL 


















o 












































































PSV 




A.1C.2 


























































































FSV 




A.1D.2 


FSV 




FA2 


A3D 
















































































































































































FA2 


A3D 


DOWNSTREAM 
FLOWLINE SEG. 


PSH 


















• 












































































3 SL 


















• 












































































3 SV 




A.1C.2 


























































































FSV 




























































































• 
































































































JAS 


1000 


GAS LIFT LINE 


PSH 




A.2A.2 


PSH 




MBD 


3000 
























































































PSH 




MBD 


4000 
























































































PSH 




CBA 


1000 


















































































PSL 




A.2B.2 


PSL 




MAF 


1000 


















































































PSV 




A.2C.2 






























































































A.2C.3 


PSV 




MAF 


1000 


















































































FSV 




























































































• 
































































































GAY 


1000 


LOW PRESSURE 
PROD. HEADER 


PSL 




A.3A.2 


PSH 




FA2 


A14D 
























































































PSH 




FA2 


A9T 


















































































PSL 




A.3B.2 


PSL 




FA2 


A14D 
























































































PSL 




FA2 


A9T 


















































































PSV 




A.3C.2 


PSV 




FA2 


A9T 
















































































































































































GAY 


2000 


LOW PRESSURE 
TEST HEADER 


PSL 




A.3A.2 


PSH 




FA2 


A14D 
























































































PSH 




FA2 


A9T 


















































































PSL 




A.3B.2 


PSL 




FA2 


A14D 
























































































PSL 




FA2 


A9T 


















































































PSV 




A.3C.2 


PSV 




FA2 


A9T 
















































































































































































GAY 


3000 


HIGH PRESSURE 
PROD. HEADER 


PSH 




A.3A.2 


PSH 




FA2 


A3D 


















































































PSL 




A.3B.2 


PSL 




FA2 


A3D 


















































































PSV 




A.3C.2 
























































































































































































GAY 


4000 


HIGH PRESSURE 
TEST HEADER 


PSH 




A.3A.2 


PSH 




FA2 


A3D 


















































































PSL 




A.3B.2 


PSL 




FA2 


A3D 


















































































PSV 




A.3C.2 
























































































































































































MBD 


1000 


LOW PRESSURE 
PROD. SEPARATOR 


PSH 














• 


• 


• 






• 


e 


• 


• 
































































PSL 














e 


• 


• 






• 


e 


• 


• 
































































PSV 






























































































LSH 














• 


o 


o 






• 


• 


• 


e 
































































LSL 


1 


A.4E.3 


























































































LSL 


2 


A.4E.3 


























































































FSV 


1 




























































































FSV 


? 




























































































FSV 


3 































































































































































































































































































































































































































































































Figure E-1 .2— Safety Analysis Function Evaluation Chart (SAFE) Example 
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Figure E-1 .2 — Safety Analysis Function Evaluation Chart (SAFE) Example 
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Figure E-2. 3— Safety Analysis Function Evaluation Chart (SAFE) 



90 



Analysis, Design, Installation, and Testing of Basic Surface Saftey Systems for Offshore Production Platforms 



3. In certain enclosed and non-enclosed areas: 

(a) as determined by the detailed design analysis (e.g., 
dispersion modeling), or 

(b) in a grid pattern with a minimum of one detector 
for each 400 square feet (37 sq. m) of floor area or 
fractional part thereof, or 

(c) within 10 feet (3m) of the following (refer to 
F.l.l): 

— All applicable vessels. 

— All applicable compressors. Compressors 

exceeding 50 HP (38 KW) should be provided with 

at least two (2) sensors. 

—All applicable pumps. 

— All applicable headers. 

— All applicable wellheads. Wells shut in at the 

master valve and sealed closed are exempt. 

When utilizing the 10 feet (3m) criteria for sen- 
sor location, one sensor may be utilized to detect 
hydrogen sulfide gas around multiple pieces of 
equipment, provided the sensor is no greater than 
10 feet (3 m) from all applicable equipment. When 
utilizing the grid configuration, maximum sensor 
spacing should be 20 feet (6 m). 

b. It is recommended that hydrogen sulfide detection instru- 
ments be approved by a nationally recognized testing labora- 
tory (NRTL) and meet ANSI/ISA S12.15, Part I: 
Performance Requirements, Hydrogen Sulfide Gas Detectors. 
Furthermore, it is recommended that hydrogen sulfide detec- 
tion systems be installed, operated, and maintained in accor- 
dance with ANSI/ISA SI 2. 1 5, Part II: Installation, 
Operation, and Maintenance of Hydrogen Sulfide Gas Detec- 
tion Instruments. 

c. Detection of .1.0 ppm of hydrogen sulfide gas in the atmo- 
sphere should initiate an audible or visual alarm, as most 
appropriate for the area where the gas has been detected. A 
visual warning system should be provided at locations such 
that personnel in approaching helicopters or boats can be 
effectively warned of the release of toxic gas when concentra- 
tions in the atmosphere around the landing area exceed 10 
ppm. Hydrogen sulfide warning alarms should be distinguish- 
able from other alarms at the location. 

d. Detection of 50 ppm of hydrogen sulfide gas in the atmo- 
sphere should initiate an audible general platform alarm and a 
visual alarm, as most appropriate for the area where the gas 
has been detected. Automatic corrective actions to control the 
source of hydrogen sulfide should be initiated. Signs and flags 
should be displayed if the concentration of gas exceeds 50 
ppm around the landing areas for boats and helicopters or if 
personnel arriving by boat or helicopter would not have 
access to safe briefing areas. Corrective action may include 
the following: 

1. A shut-in of the sour production handling equipment, 
applicable wells, and pipelines/flow lines. 



2. Blowdown of certain process equipment. 

3. Providing (or increasing) ventilation. 

In lieu of total process shut in, it is acceptable to isolate 
alarmed areas; an example is closing an inlet valve to a 
compressor building. It may be desirable in certain 
instances for H2S detectors not to initiate shut-in/isolation 
action, but to alarm only. 

Careful consideration should be given to the form of 
automatic corrective action taken to ensure that the situa- 
tion is not made more hazardous. 

Shutdown devices controlled by hydrogen sulfide gas 
detection systems should be installed "normally ener- 
gized" (commonly referred to as "failsafe"). Refer to API 
Recommended Practice 14F, Section 9, "Special Systems". 

e. In addition to being toxic, hydrogen sulfide gas is combus- 
tible. The range of combustibility is approximately 4.3 to 
45.5% by volume. Areas subject to combustible levels of 
hydrogen sulfide should be classified as Group C and electri- 
cal equipment should be suitable for Groups C & D atmo- 
spheres. For mixtures of hydrogen sulfide and natural gas, the 
mixture should be considered Group D if the hydrogen sul- 
fide constitutes less than 25% of the mixture (by volume) and 
Groups C and D if greater than 25%. If machinery or equip- 
ment shutdown could create an ignition source, consideration 
should be given to actuation of a fire inerting system prior to 
shutdown. 

f. If sour gas is sweetened to reduce personnel exposure haz- 
ard or for equipment protection, the sweetened gas should be 
continuously monitored for hydrogen sulfide prior to the gas 
leaving the facility, and preferably before being utilized for 
fuel or control gas at the facility. Devices specifically 
designed for analyzing an instream sample for hydrogen sul- 
fide content on a continuous basis should be utilized. 

g. To better ensure proper application of H 2 S detection 
instruments, it is recommended that an environment and 
application checklist (similar to the example shown in 
Appendix A, ANSI/ISA-RP1 2. 1 5, Part II) be provided to pro- 
spective suppliers by the user. 

F.1.3 Systems for Discharging Hydrogen Sulfide 
and Sulfur Dioxide to Atmosphere 

Discharge of pressure relief and normally venting devices 
should be located away from work areas and designed to pro- 
vide adequate dispersion and to limit personnel exposure to 
hydrogen sulfide and sulfur dioxide concentrations not 
exceeding those discussed in F.l.l. If dispersion modeling 
determines that ignition of vented gas is required, the flare 
outlets should be equipped with an automatic ignition system 
and contain a pilot(s) or other means to ensure combustion. 
On platforms where flaring is required, failure of the auto- 
matic ignition system and loss of flare should shut in the input 
source. 



APPENDIX G— DEFINITIONS 



G.1 abnormal operating condition: Condition that 
occurs in a process component when an operating variable 
ranges outside of its normal operating limits. 

G.2 atmospheric service: Refers to operation at 

gauge pressures between V2 ounce per square inch (0.2 kPa) 
vacuum and 5 pounds per square inch (35 kPa) pressure. 

G.3 automatically fired vessel: Fired vessel with the 
burner fuel controlled by an automatic temperature or pres- 
sure controller. 

G.4 backflow: Fluid flow in a process component oppo- 
site to the normal flow direction. 

G.5 blowdown valve: An automatically operated nor- 
mally open valve used to vent the pressure from a process sta- 
tion on shutdown. 

G.6 classified area: Any area electrically classified 
Class I, Group D, Division 1 or 2, following guidelines of 
API Recommended Practice 500. 

G.7 containment: Any method used on an offshore 

platform to collect and direct escaped liquid hydrocarbons to 
a safe location. 

G.8 detectable abnormal condition: An abnormal 
operating condition that can be automatically detected. 

G.9 direct ignition source: Point of sufficient tem- 
perature and heat capacity to ignite a combustible mixture. 

G.10 emergency shutdown (ESD) system: Sys- 
tem of manual stations that, when activated, will initiate plat- 
form shutdown. 

G.11 excess temperature: Temperature in a process 
component in excess of the rated working temperature. 

G.1 2 failure: Improper performance of a device or 

equipment item that prevents completion of its design func- 
tion. 

G.13 fired vessel: A vessel in which the temperature of 
a fluid is increased by the addition of heat supplied by a flame 
within the vessel. 

G.14 fire loop: A pneumatic control line containing 
temperature sensing elements (fusible plugs, synthetic tubing, 
etc.) that, when activated, will initiate platform shutdown. 

G.15 flame failure: A flame that is inadequate to 
instantaneously ignite combustible vapors entering the firing 
chamber. 



G.16 flowline: Piping that directs the well stream from 
the wellhead to the first downstream process component. 

Note: The words "flow line' 1 and "flow line 11 are used interchange- 
ably throughout this document. 

G.17 flowline segment: Any portion of a flow line 
that has an operating pressure different from another portion 
of the same flow line. 

G.1 8 gas blowby: The discharge of gas from a process 
component through a liquid outlet. 

G.19 gas detection system: Control system that 
monitors the concentration of combustible gases and initiates 
alarm and shutdown functions at predetermined concentra- 
tions. 

G.20 high liquid level: Liquid level in a process com- 
ponent above the highest operating level. 

G.21 high pressure: Pressure in a process component 
in excess of the maximum operating pressure but less than the 
maximum allowable working pressure (for pipelines, maxi- 
mum allowable operating pressure). 

G.22 high temperature: Temperature in a process 
component in excess of the design operating temperature. 

G.23 indirect heated component: Vessel or heat 
exchanger used to increase the temperature of a fluid by the 
transfer of heat from another fluid, such as steam, hot water, 
hot oil, or other heated medium. 

G.24 leak: The accidental escape from a process compo- 
nent of liquid and/or gaseous hydrocarbons to atmosphere. 

G.25 liquid overflow: The discharge of liquids from a 
process component through a gas (vapor) outlet. 

G.26 lower explosive limit (LEL): The lowest con- 
centration by volume of combustible gases in mixture with air 
that can be ignited at ambient conditions. 

G.27 low flow: Flow in a process component less than 
the minimum operating flow rate. 

G.28 low liquid level: Liquid level in a process compo- 
nent below the lowest operating level. 

G.29 low pressure: Pressure in a process component 
less than the minimum operating pressure. 

G.30 low temperature: Temperature in a process com- 
ponent less than the minimum operating temperature. 

G.31 malfunction: Any condition of a device or an 
equipment item that causes it to operate improperly, but does 
not prevent the performance of its design function. 
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G.32 maximum allowable operating pressure: 

The highest operating pressure allowable at any point in a 
pipeline system during normal flow or static conditions. 

G.33 maximum allowable working pressure: The 

highest operating pressure allowable at any point in any com- 
ponent other than a pipeline during normal operation or static 
conditions. 

G.34 normally closed valve: A valve that will shift to 
the closed position upon loss of the power medium. 

G.35 normally open valve: A valve that will shift to 
the open position upon loss of the power medium. 

G.36 overpressure: Pressure in a process component 
in excess of the maximum allowable working pressure (for 
pipelines, maximum allowable operating pressures). 

G.37 pipeline: Piping that directs fluids between plat- 
forms or between a platform and a shore facility. 

G.38 platform safety system: An arrangement of 
safety devices and emergency support systems to effect plat- 
form shutdown. The system may consist of a number of indi- 
vidual process shutdowns and may be actuated by either 
manual controls or automatic devices sensing detectable 
abnormal conditions. 

G.39 platform shutdown: The shutting in of all pro- 
cess stations of a platform production process and all support 
equipment for the process. 

G.40 pneumatic power system: A system that sup- 
plies pressure to operate pneumatic actuators. 

G.41 process component: A single functional piece 
of production equipment and associated piping used in a pro- 
cess station, such as a separator, heater, pump, or tank. 

G.42 process shutdown: The isolation of a given 
process station from the process by closing appropriate SDVs 
to shut in flow to the process station or divert flow to another 
process station. 

G.43 process station: One or more process compo- 
nents performing a specific process function, such as separat- 
ing, heating, pumping, etc. 

G.44 qualified person: An individual with character- 
istics or abilities gained through training or experience or 



both, as measured against established requirements, such as 
standards or tests, that enable the individual to perform a 
required function. 



G.45 safety device: 

within the safety system. 



An instrument or control used 



G.46 sensor: A device that detects an abnormal operat- 
ing condition and transmits a signal to perform a specific 
shutdown function. 

G.47 shutdown valve (SDV): An automatically-oper- 
ated, normally closed valve used for isolating a process station. 

G.48 SITP: Shut-in tubing pressure. 

G.49 subsurface safety valve (SSSV): A device 

installed in a well below the wellhead with the design func- 
tion to prevent uncontrolled well flow when actuated. 

G.50 subsurface controlled subsurface safety 
valve (SSCSV): An SSSV actuated by the pressure char- 
acteristics of the well. 

G.51 surface controlled subsurface safety valve 
(SCSSV): An SSSV controlled from the surface by 
hydraulic, electric, mechanical, or other means. 

G.52 surface safety valve (SSV): An automatic 
wellhead valve assembly that will close upon loss of 
power supply. 

G.53 underpressure: Pressure in a process component 
less than the design collapse pressure. 

G.54 underwater safety valve (USV): An automatic 
valve assembly (installed at an underwater wellhead location) 
that will close upon loss of power supply. 

G.55 undesirable event: An adverse occurrence or 
situation in a process component or process station that poses 
a threat to safety, such as overpressure, underpressure, liquid 
overflow, etc. 

G.56 vacuum: Pressure in a process component less 
than atmospheric pressure. 

G.57 vent: A pipe or fitting (e.g., tank flange) on a ves- 
sel that opens to the atmosphere. A vent might contain a pres- 
sure and/or vacuum relief device. 
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